rpms/perl-DBI
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-9698: possible stack overflow in DBI.xs

Browse Source 
Backport upstream fix for CVE-2026-9698, a stack buffer overflow
in DBI.xs. The patch replaces a fixed-size 200-byte stack buffer
used with sprintf() by a dynamically allocated SV via
sv_2mortal(newSVpvf(...)), eliminating the overflow vulnerability.

CVE: CVE-2026-9698
Upstream patches:
 - bfe5d73c16.patch
Resolves: RHEL-184982

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-30 10:08:20 +00:00
parent 2fe3154fbc
commit e9af262305
2 changed files with 41 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
DBI-1.643-Fix-CVE-2026-9698.patch Normal file
View File

@ -0,0 +1,34 @@
From c86476918f64150ca4bae2f39004aadb1ec6fa23 Mon Sep 17 00:00:00 2001
From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
Date: Wed, 27 May 2026 11:16:50 +0200
Subject: [PATCH] Fix possible stack overflow (old issue already noted by Tim)
---
DBI.xs | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/DBI.xs b/DBI.xs
index 2cea4ac..c549d15 100644
--- a/DBI.xs
+++ b/DBI.xs
@@ -3998,7 +3998,6 @@ XS(XS_DBI_dispatch)
SV **statement_svp = NULL;
const int is_warning = (!SvTRUE(err_sv) && strlen(SvPV_nolen(err_sv))==1);
const char *err_meth_name = meth_name;
- char intro[200];
if (meth_type == methtype_set_err) {
SV **sem_svp = hv_fetch((HV*)SvRV(h), "dbi_set_err_method", 18, GV_ADDWARN);
@@ -4006,10 +4005,8 @@ XS(XS_DBI_dispatch)
err_meth_name = SvPV_nolen(*sem_svp);
}
- /* XXX change to vsprintf into sv directly */
- sprintf(intro,"%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name,
- SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information");
- msg = sv_2mortal(newSVpv(intro,0));
+ msg = sv_2mortal(newSVpvf("%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name,
+ SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information"));
if (SvOK(DBIc_ERRSTR(imp_xxh)))
sv_catsv(msg, DBIc_ERRSTR(imp_xxh));
else

8
perl-DBI.spec
View File

@ -34,7 +34,7 @@
Name: perl-DBI
Version: 1.643
Release: 26%{?dist}
Release: 27%{?dist}
Summary: A database access API for perl
License: GPL-1.0-or-later OR Artistic-1.0-Perl
URL: http://dbi.perl.org/
@ -44,6 +44,8 @@ Patch0: DBI-1.643-Fix-for-CVE-2014-10401.patch
Patch1: DBI-1.643-Fix-for-empty-attributes-in-DSN.patch
Patch2: DBI-1.643-Catch-warning.patch
Patch3: DBI-1.643-Document-the-new-behavior-for-f_dir.patch
# RHEL-184982, CVE-2026-9698, Fix possible stack overflow in DBI.xs
Patch4: DBI-1.643-Fix-CVE-2026-9698.patch
BuildRequires: coreutils
BuildRequires: findutils
BuildRequires: gcc
@ -277,6 +279,10 @@ make test
%{_libexecdir}/%{name}
%changelog
* Thu Jul 30 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.643-27
- Fix CVE-2026-9698: stack buffer overflow in DBI.xs
Resolves: RHEL-184982
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1.643-26
- Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018