Fix CVE-2026-9698: stack and buffer overflow in perl-DBI

Backport two upstream fixes for CVE-2026-9698 to perl-DBI:

- Fix possible stack overflow in XS_DBI_dispatch by replacing
  a fixed-size char[200] buffer with dynamic newSVpvf() allocation.
- Fix buffer overflow in preparse() by increasing the allocation
  from strlen(statement)*3 to strlen(statement)*6+16 to account
  for longer placeholder replacements.

Both fixes are combined in a single patch file
DBI-1.643-Fix-CVE-2026-9698.patch.

CVE: CVE-2026-9698
Upstream patches:
 - bfe5d73c16.patch
 - af79036c07.patch
Resolves: RHEL-184983

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir

DBI-1.643-Fix-CVE-2026-9698.patch

@@ -0,0 +1,60 @@
+From 84010491705a3d49c23ac93b9086567869bcd920 Mon Sep 17 00:00:00 2001
+From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
+Date: Wed, 27 May 2026 11:16:50 +0200
+Subject: [PATCH 1/2] Fix possible stack overflow (old issue already noted by
+ Tim)
+
+---
+ DBI.xs | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/DBI.xs b/DBI.xs
+index 2cea4ac..c549d15 100644
+--- a/DBI.xs
++++ b/DBI.xs
+@@ -3998,7 +3998,6 @@ XS(XS_DBI_dispatch)
+         SV **statement_svp = NULL;
+         const int is_warning = (!SvTRUE(err_sv) && strlen(SvPV_nolen(err_sv))==1);
+         const char *err_meth_name = meth_name;
+-        char intro[200];
+ 
+         if (meth_type == methtype_set_err) {
+             SV **sem_svp = hv_fetch((HV*)SvRV(h), "dbi_set_err_method", 18, GV_ADDWARN);
+@@ -4006,10 +4005,8 @@ XS(XS_DBI_dispatch)
+                 err_meth_name = SvPV_nolen(*sem_svp);
+         }
+ 
+-        /* XXX change to vsprintf into sv directly */
+-        sprintf(intro,"%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name,
+-            SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information");
+-        msg = sv_2mortal(newSVpv(intro,0));
++        msg = sv_2mortal(newSVpvf("%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name,
++            SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information"));
+         if (SvOK(DBIc_ERRSTR(imp_xxh)))
+             sv_catsv(msg, DBIc_ERRSTR(imp_xxh));
+         else
+
+From 963d3dd7d4feae5f1ed43db5021fdf44b60088ff Mon Sep 17 00:00:00 2001
+From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
+Date: Thu, 28 May 2026 14:14:50 +0200
+Subject: [PATCH 2/2] Replacing `?` with `:p#` in `preparse ()` with more than
+ 9 `?` causes buffer overflow
+
+`:p1` is length 3, `?` just 1, but `:p1003` is length 6!
+---
+ DBI.xs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/DBI.xs b/DBI.xs
+index c549d15..8858e21 100644
+--- a/DBI.xs
++++ b/DBI.xs
+@@ -4201,7 +4201,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+     }
+ 
+     /* XXX this allocation strategy won't work when we get to more advanced stuff */
+-    new_stmt_sv = newSV(strlen(statement) * 3);
++    new_stmt_sv = newSV(strlen(statement) * 6 + 16);
+     sv_setpv(new_stmt_sv,"");
+     src  = statement;
+     dest = SvPVX(new_stmt_sv);

perl-DBI.spec

@@ -34,11 +34,13 @@
 
 Name:           perl-DBI
 Version:        1.643
-Release:        9%{?dist}
+Release:        10%{?dist}
 Summary:        A database access API for perl
 License:        GPL+ or Artistic
 URL:            http://dbi.perl.org/
 Source0:        https://cpan.metacpan.org/authors/id/T/TI/TIMB/DBI-%{version}.tar.gz
+# RHEL-184983, CVE-2026-9698, Fix stack overflow and buffer overflow in DBI.xs
+Patch0:         DBI-1.643-Fix-CVE-2026-9698.patch
 BuildRequires:  coreutils
 BuildRequires:  findutils
 BuildRequires:  gcc
@@ -154,6 +156,7 @@ the use of existing DBI frameworks like DBIx::Class.
 
 %prep
 %setup -q -n DBI-%{version} 
+%patch0 -p1
 for F in lib/DBD/Gofer.pm; do
     iconv -f ISO-8859-1 -t UTF-8 < "$F" > "${F}.utf8"
     touch -r "$F" "${F}.utf8"
@@ -218,6 +221,10 @@ make test
 %endif
 
 %changelog
+* Thu Jul 30 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.643-10
+- Fix stack overflow and buffer overflow in DBI.xs (CVE-2026-9698)
+  Related: RHEL-184983
+
 * Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.643-9
 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
   Related: rhbz#1991688