mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-10-22 08:28:21 +00:00
Hetvi Thakar
ef3df29f2c
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-14740 Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
41 lines
1.5 KiB
Diff
41 lines
1.5 KiB
Diff
From 016bd2b384ed34185a1770312124ceca0086d7a8 Mon Sep 17 00:00:00 2001
|
|
From: Robert Rothenberg <perl@rhizomnic.com>
|
|
Date: Sat, 4 Jul 2026 10:49:42 +0100
|
|
Subject: [PATCH] Fix out-of-bounds read in preparse when an initial comment is
|
|
deleted
|
|
|
|
This fixes CVE-2026-14740
|
|
|
|
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
|
|
|
Signed-off-by: Robert Rothenberg <rrwo@cpansec.org>
|
|
|
|
CVE: CVE-2026-14740
|
|
Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01]
|
|
|
|
(cherry picked from commit fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01)
|
|
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
|
|
---
|
|
DBI.xs | 8 +++++++-
|
|
1 file changed, 7 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/DBI.xs b/DBI.xs
|
|
index 23ad34a..f40c17a 100644
|
|
--- a/DBI.xs
|
|
+++ b/DBI.xs
|
|
@@ -4237,7 +4237,13 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
|
|
}
|
|
if (in_comment == '/')
|
|
src++;
|
|
- src += (*src != '\n' || *(dest-1)=='\n') ? 1 : 0;
|
|
+ /* Only inspect the previously-emitted byte if one exists;
|
|
+ when an initial line comment is deleted, dest is still at
|
|
+ the start of the output buffer and *(dest-1) would read
|
|
+ one byte before it (OOB read). */
|
|
+ src += (*src != '\n'
|
|
+ || (dest > SvPVX(new_stmt_sv) && *(dest-1)=='\n'))
|
|
+ ? 1 : 0;
|
|
in_comment = '\0';
|
|
rt_comment = '\0';
|
|
}
|