[meta-oe][wrynose][PATCH 5/5] libdbi-perl: Fix CVE-2026-14740

From: Hetvi Thakar <[email protected]>

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-14740

Signed-off-by: Hetvi Thakar <[email protected]>
---
 .../perl/libdbi-perl/CVE-2026-14740.patch     | 39 +++++++++++++++++++
 .../perl/libdbi-perl_1.647.bb                 |  1 +
 2 files changed, 40 insertions(+)
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14740.patch

diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14740.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14740.patch
new file mode 100644
index 0000000000..9118bcf633
--- /dev/null
+++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14740.patch
@@ -0,0 +1,39 @@
+From 65a5eecd6845ed1c29ede9bbe0b651fa3ba3cc2d Mon Sep 17 00:00:00 2001
+From: Robert Rothenberg <[email protected]>
+Date: Sat, 4 Jul 2026 10:49:42 +0100
+Subject: [PATCH] Fix out-of-bounds read in preparse when an initial comment is
+ deleted
+
+This fixes CVE-2026-14740
+
+CVE: CVE-2026-14740
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01]
+
+Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
+
+Signed-off-by: Robert Rothenberg <[email protected]>
+(cherry picked from commit fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01)
+Signed-off-by: Hetvi Thakar <[email protected]>
+---
+ DBI.xs | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/DBI.xs b/DBI.xs
+index 0f9ea9c..da5d137 100644
+--- a/DBI.xs
++++ b/DBI.xs
+@@ -4239,7 +4239,13 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+                 }
+                 if (in_comment == '/')
+                     src++;
+-                src += (*src != '\n' || *(dest-1)=='\n') ? 1 : 0;
++                /* Only inspect the previously-emitted byte if one exists;
++                   when an initial line comment is deleted, dest is still at
++                   the start of the output buffer and *(dest-1) would read
++                   one byte before it (OOB read). */
++                src += (*src != '\n'
++                        || (dest > SvPVX(new_stmt_sv) && *(dest-1)=='\n'))
++                       ? 1 : 0;
+                 in_comment = '\0';
+                 rt_comment = '\0';
+              }
diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb
index 688b63d534..883827e270 100644
--- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb
+++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb
@@ -14,6 +14,7 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \
            file://CVE-2026-10879.patch \
            file://CVE-2026-14380.patch \
            file://CVE-2026-14739.patch \
+           file://CVE-2026-14740.patch \
            "
 SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa"
 
-- 
2.35.6