mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-10-22 08:28:21 +00:00
Hetvi Thakar
3304a04085
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978 [2] https://security-tracker.debian.org/tracker/CVE-2026-10879 Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
35 lines
1.3 KiB
Diff
35 lines
1.3 KiB
Diff
From 2a69c8a256fa83dee2e532c97d3f60f39795c861 Mon Sep 17 00:00:00 2001
|
|
From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
|
|
Date: Thu, 28 May 2026 14:14:50 +0200
|
|
Subject: [PATCH] Replacing `?` with `:p#` in `preparse ()` with more than 9
|
|
`?` causes buffer overflow
|
|
|
|
`:p1` is length 3, `?` just 1, but `:p1003` is length 6!
|
|
|
|
CVE: CVE-2026-10879
|
|
Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978]
|
|
|
|
Backport Changes:
|
|
- Omit ChangeLog, dbixs_rev.h, and lib/DBI/Changes.pm release metadata because the target remains DBI 1.643.
|
|
- Omit generated doc/DBI.3 and doc/DBI.man changes; the DBI.xs security hunk is unchanged.
|
|
|
|
(cherry picked from commit af79036c07aa9a457971c0f4136e37c85dc20978)
|
|
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
|
|
---
|
|
DBI.xs | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/DBI.xs b/DBI.xs
|
|
index c549d15..8858e21 100644
|
|
--- a/DBI.xs
|
|
+++ b/DBI.xs
|
|
@@ -4201,7 +4201,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
|
|
}
|
|
|
|
/* XXX this allocation strategy won't work when we get to more advanced stuff */
|
|
- new_stmt_sv = newSV(strlen(statement) * 3);
|
|
+ new_stmt_sv = newSV(strlen(statement) * 6 + 16);
|
|
sv_setpv(new_stmt_sv,"");
|
|
src = statement;
|
|
dest = SvPVX(new_stmt_sv);
|