rpms/perl-DBI
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS git perl-DBI-1.641-5.el8

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-07-13 09:35:03 -04:00
parent 89ea74e008
commit e987fd7336
2 changed files with 74 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
SOURCES/DBI-1.641-Fix-CVE-2026-9698.patch Normal file
View File

@ -0,0 +1,66 @@
From 73fa0162f834094189c4e7f4a24e165f5d3bbe5c Mon Sep 17 00:00:00 2001
From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
Date: Wed, 27 May 2026 11:16:50 +0200
Subject: [PATCH 1/2] Fix possible stack overflow (old issue already noted by
Tim)
---
DBI.xs | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/DBI.xs b/DBI.xs
index 3b55e56..53d68b1 100644
--- a/DBI.xs
+++ b/DBI.xs
@@ -4012,7 +4012,6 @@ XS(XS_DBI_dispatch)
SV **statement_svp = NULL;
const int is_warning = (!SvTRUE(err_sv) && strlen(SvPV_nolen(err_sv))==1);
const char *err_meth_name = meth_name;
- char intro[200];
if (meth_type == methtype_set_err) {
SV **sem_svp = hv_fetch((HV*)SvRV(h), "dbi_set_err_method", 18, GV_ADDWARN);
@@ -4020,10 +4019,8 @@ XS(XS_DBI_dispatch)
err_meth_name = SvPV_nolen(*sem_svp);
}
- /* XXX change to vsprintf into sv directly */
- sprintf(intro,"%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name,
- SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information");
- msg = sv_2mortal(newSVpv(intro,0));
+ msg = sv_2mortal(newSVpvf("%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name,
+ SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information"));
if (SvOK(DBIc_ERRSTR(imp_xxh)))
sv_catsv(msg, DBIc_ERRSTR(imp_xxh));
else
--
2.52.0
From f433dec6b8caf9e8d1df2d3428b9008b01a9da5f Mon Sep 17 00:00:00 2001
From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
Date: Thu, 28 May 2026 14:14:50 +0200
Subject: [PATCH 2/2] Replacing `?` with `:p#` in `preparse ()` with more than
9 `?` causes buffer overflow
`:p1` is length 3, `?` just 1, but `:p1003` is length 6!
---
DBI.xs | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/DBI.xs b/DBI.xs
index 53d68b1..d7120a7 100644
--- a/DBI.xs
+++ b/DBI.xs
@@ -4213,7 +4213,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
}
/* XXX this allocation strategy won't work when we get to more advanced stuff */
- new_stmt_sv = newSV(strlen(statement) * 3);
+ new_stmt_sv = newSV(strlen(statement) * 6 + 16);
sv_setpv(new_stmt_sv,"");
src = statement;
dest = SvPVX(new_stmt_sv);
--
2.52.0

9
SPECS/perl-DBI.spec
View File

@ -34,11 +34,13 @@
Name: perl-DBI
Version: 1.641
Release: 4%{?dist}
Release: 5%{?dist}
Summary: A database access API for perl
License: GPL+ or Artistic
URL: http://dbi.perl.org/
Source0: http://www.cpan.org/authors/id/T/TI/TIMB/DBI-%{version}.tar.gz
# RHEL-184974, CVE-2026-9698, Fix stack overflow and buffer overflow in DBI.xs
Patch0: DBI-1.641-Fix-CVE-2026-9698.patch
BuildRequires: coreutils
BuildRequires: findutils
BuildRequires: gcc
@ -154,6 +156,7 @@ the use of existing DBI frameworks like DBIx::Class.
%prep
%setup -q -n DBI-%{version}
%patch -P0 -p1
for F in lib/DBD/Gofer.pm; do
iconv -f ISO-8859-1 -t UTF-8 < "$F" > "${F}.utf8"
touch -r "$F" "${F}.utf8"
@ -217,6 +220,10 @@ make test
%endif
%changelog
* Mon Jun 22 2026 Michal Josef Špaček <mspacek@redhat.com> - 1.641-5
- Fix stack overflow and buffer overflow in DBI.xs (CVE-2026-9698)
Resolves: RHEL-184974
* Mon Nov 22 2021 Jitka Plesnikova <jplesnik@redhat.com> - 1.641-4
- BR: perl(blib), perl(FileHandle) for tests