Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package perl-DBI for openSUSE:Factory checked in at 2026-07-09 22:18:24 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/perl-DBI (Old) and /work/SRC/openSUSE:Factory/.perl-DBI.new.1991 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-DBI" Thu Jul 9 22:18:24 2026 rev:58 rq:1364468 version:1.650.0 Changes: -------- --- /work/SRC/openSUSE:Factory/perl-DBI/perl-DBI.changes 2026-06-22 18:05:18.752975252 +0200 +++ /work/SRC/openSUSE:Factory/.perl-DBI.new.1991/perl-DBI.changes 2026-07-09 22:18:36.656556600 +0200 @@ -1,0 +2,22 @@ +Wed Jul 8 08:28:37 UTC 2026 - Tina Müller <[email protected]> + +- updated to 1.650.0 (1.650) + see /usr/share/doc/packages/perl-DBI/ChangeLog + + 1.650 - 2026-07-06, H.Merijn Brand & Robert Rothenberg + * Set a hard limit of 99999 on '?' placeholders (CVE-2026-14739) + * Fix out-of-bounds read in preparse of SQL that starts with a comment (CVE-2026-14740) bsc#1271017 + * Fix code injection via Profile DSN attribute or DBI_PROFILE variable (CVE-2026-14380) bsc#1271018 + * Update dbipport.h to Devel::PPPort-3.73 + * Require Test::More 0.96 (tests will otherwise fail on pristine perl-5.12) + +------------------------------------------------------------------- +Mon Jun 22 10:50:51 UTC 2026 - Tina Müller <[email protected]> + +- updated to 1.649.0 (1.649) + see /usr/share/doc/packages/perl-DBI/ChangeLog + + 1.649 - 2026-06-22, H.Merijn Brand + * Extra Cwd::abs_path required for Windows + +------------------------------------------------------------------- Old: ---- DBI-1.648.tgz New: ---- DBI-1.650.tgz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ perl-DBI.spec ++++++ --- /var/tmp/diff_new_pack.GKMPAt/_old 2026-07-09 22:18:37.352580296 +0200 +++ /var/tmp/diff_new_pack.GKMPAt/_new 2026-07-09 22:18:37.356580432 +0200 @@ -18,10 +18,10 @@ %define cpan_name DBI Name: perl-DBI -Version: 1.648.0 +Version: 1.650.0 Release: 0 -# 1.648 -> normalize -> 1.648.0 -%define cpan_version 1.648 +# 1.650 -> normalize -> 1.650.0 +%define cpan_version 1.650 License: Artistic-1.0 OR GPL-1.0-or-later Summary: Database independent interface for Perl URL: https://metacpan.org/release/%{cpan_name} @@ -32,7 +32,9 @@ BuildRequires: perl BuildRequires: perl-macros BuildRequires: perl(ExtUtils::MakeMaker) >= 6.48 -BuildRequires: perl(Test::Simple) >= 0.90 +BuildRequires: perl(Module::Load) >= 0.22 +BuildRequires: perl(Test::Simple) >= 0.96 +Requires: perl(Module::Load) >= 0.22 Provides: perl(Bundle::DBI) = 12.8.696 Provides: perl(DBD::DBM) = 0.80.0 Provides: perl(DBD::DBM::Statement) @@ -165,6 +167,6 @@ %perl_gen_filelist %files -f %{name}.files -%doc ChangeLog Driver.xst README.md +%doc ChangeLog CONTRIBUTING.md Driver.xst README.md %license LICENSE ++++++ DBI-1.648.tgz -> DBI-1.650.tgz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/CONTRIBUTING.md new/DBI-1.650/CONTRIBUTING.md --- old/DBI-1.648/CONTRIBUTING.md 1970-01-01 01:00:00.000000000 +0100 +++ new/DBI-1.650/CONTRIBUTING.md 2026-07-04 16:24:41.000000000 +0200 @@ -0,0 +1,44 @@ +# How to Contribute + +Help with DBI is always welcome in all areas: code, tests, documentation. +Just reach out to se where we think the pressure point are. + +## Issues + +Bugs and problems can be reported at: + +https://github.com/perl5-dbi/dbi/issues + +## Questions + +Questions about usage can be answered in a number of places: + +### IRC + +You may find helpful people at #dbi on irc.perl.org - people might not be +around the moment you ask the question, but an answer is likely to be given. + +## Testing + +You can help by testing DBI as widely as possible. Running the tests +on a wide variety of platforms in as many configurations as possible (32bit +vs 64-bit, threaded vs non-threaded, big-endian vs lower endian, quadmath, +parallel testing vs single process testing, limited resources vs extreme +resources), database types and versions, DBI versions, and other factors is +a great help in uncovering problems and improving DBI. + +## Code development + +Development happens in a git repo. The canonical location is currently +at https://github.com/perl5-dbi/dbi/ + +Create your own copy of the repo by running: + +git clone https://github.com/perl5-dbi/dbi.git + +## Guides + +### Code style and layout + +This code has long history and was developed by multiple authors. Try to +keep the style of the new or modified code in line with the surrounding code. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/ChangeLog new/DBI-1.650/ChangeLog --- old/DBI-1.648/ChangeLog 2026-06-04 15:46:31.000000000 +0200 +++ new/DBI-1.650/ChangeLog 2026-07-06 11:43:59.000000000 +0200 @@ -1,3 +1,13 @@ +1.650 - 2026-07-06, H.Merijn Brand & Robert Rothenberg + * Set a hard limit of 99999 on '?' placeholders (CVE-2026-14739) + * Fix out-of-bounds read in preparse of SQL that starts with a comment (CVE-2026-14740) + * Fix code injection via Profile DSN attribute or DBI_PROFILE variable (CVE-2026-14380) + * Update dbipport.h to Devel::PPPort-3.73 + * Require Test::More 0.96 (tests will otherwise fail on pristine perl-5.12) + +1.649 - 2026-06-22, H.Merijn Brand + * Extra Cwd::abs_path required for Windows + 1.648 - 2026-06-04, H.Merijn Brand * Correct sprintf usage for trace_msg (issue#132) * Add DBIXS_VERSION & DBIXS_RELEASE to dbixs_rev.h @@ -5,7 +15,7 @@ * Fix possible stack overflow (old issue already noted by Tim) (CVE-2026-9698) * Do not allow table source locations outside explicit given folders * DBD::Sponge PRECISION handling (pr#12, pilcrow) - * Fix possible buffer overflow in preparse + * Fix possible buffer overflow in preparse (CVE-2026-10879) * Skip mismatching .so's (Greg, PR#81) * Fix cast warning in dbi_get_state (Greg, PR#182) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/DBI.pm new/DBI-1.650/DBI.pm --- old/DBI-1.648/DBI.pm 2026-05-28 14:03:15.000000000 +0200 +++ new/DBI-1.650/DBI.pm 2026-07-05 13:53:14.000000000 +0200 @@ -16,7 +16,7 @@ our ($XS_VERSION, $VERSION); BEGIN { -$VERSION = "1.648"; # ==> ALSO update the version in the pod text below! +$VERSION = "1.650"; # ==> ALSO update the version in the pod text below! $XS_VERSION = $VERSION; $VERSION =~ tr/_//d; } @@ -148,7 +148,7 @@ =head2 NOTES -This is the DBI specification that corresponds to DBI version 1.648 +This is the DBI specification that corresponds to DBI version 1.650 (see L<DBI::Changes> for details). The DBI is evolving at a steady pace, so it's good to check that @@ -7137,7 +7137,8 @@ It is possible that the keys in the hash returned by C<ParamValues> are not exactly the same as those implied by the prepared statement. For example, DBD::Oracle translates 'C<?>' placeholders into 'C<:pN>' -where N is a sequence number starting at 1. +where N is a sequence number starting at C<1> with a hard limit of +C<99999>. * Values: @@ -7239,7 +7240,8 @@ It is also possible that the keys in the hash returned by C<ParamArrays> are not exactly the same as those implied by the prepared statement. For example, DBD::Oracle translates 'C<?>' -placeholders into 'C<:pN>' where N is a sequence number starting at 1. +placeholders into 'C<:pN>' where N is a sequence number starting at +C<1> with a hard limit of C<99999>. =head3 C<RowsInCache> @@ -8342,8 +8344,10 @@ =head1 ACKNOWLEDGEMENTS +The creator: Tim Bunce! + I would like to acknowledge the valuable contributions of the many -people I have worked with on the DBI project, especially in the early +people Tim has worked with on the DBI project, especially in the early years (1992-1994). In no particular order: Kevin Stock, Buzz Moschetti, Kurt Andersen, Ted Lemon, William Hails, Garth Kennedy, Michael Peppler, Neil S. Briscoe, Jeff Urlwin, David J. Hughes, Jeff Stander, @@ -8371,12 +8375,16 @@ The development of DBD::Gofer and related modules was sponsored by Shopzilla.com (L<https::connexity.com>). +After the release of version 1.643, the development was lead by H.Merijn Brand +with the help of the DBI team. Thanks to all that added issues, did Pull +Requests or helped in any way to keep the DBI healthy. + =head1 CONTRIBUTING As you can see above, many people have contributed to the DBI and drivers in many ways over many years. -If you'd like to help then see L<http://dbi.perl.org/contributing>. +If you'd like to help then see F<CONTRIBUTING.md>. If you'd like the DBI to do something new or different then a good way to make that happen is to do it yourself and send me a patch to the diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/DBI.xs new/DBI-1.650/DBI.xs --- old/DBI-1.648/DBI.xs 2026-05-28 14:05:15.000000000 +0200 +++ new/DBI-1.650/DBI.xs 2026-07-05 13:53:14.000000000 +0200 @@ -4203,7 +4203,14 @@ } /* XXX this allocation strategy won't work when we get to more advanced stuff */ - new_stmt_sv = newSV(strlen(statement) * 6 + 16); + /* The 7 is for length increase from '?' (length 1) to :p99999 (length 7) + * which imposes a limit of 99999 '?' placeholders POSIX style. Actual counts + * are a bit higher: + * using factor 5: :p1 .. :p1107 + * using factor 6: :p1 .. :p11106 + * using factor 7: :p1 .. :p111105 + * and that count is insane already */ + new_stmt_sv = newSV(strlen(statement) * 7 + 16); sv_setpv(new_stmt_sv,""); src = statement; dest = SvPVX(new_stmt_sv); @@ -4232,7 +4239,13 @@ } if (in_comment == '/') src++; - src += (*src != '\n' || *(dest-1)=='\n') ? 1 : 0; + /* Only inspect the previously-emitted byte if one exists; + when an initial line comment is deleted, dest is still at + the start of the output buffer and *(dest-1) would read + one byte before it (OOB read). */ + src += (*src != '\n' + || (dest > SvPVX(new_stmt_sv) && *(dest-1)=='\n')) + ? 1 : 0; in_comment = '\0'; rt_comment = '\0'; } @@ -4342,9 +4355,9 @@ continue; } - if ( !(*src==':' && (PS_accept(DBIpp_ph_cn) || PS_accept(DBIpp_ph_cs))) - && !(*src=='?' && PS_accept(DBIpp_ph_qm)) - ){ + if ( !(*src==':' && (PS_accept(DBIpp_ph_cn) || PS_accept(DBIpp_ph_cs))) + && !(*src=='?' && PS_accept(DBIpp_ph_qm)) + ){ if (*src == '\'' || *src == '"') in_quote = *src; *dest++ = *src++; @@ -4363,12 +4376,18 @@ if (PS_return(DBIpp_ph_qm)) ; else if (PS_return(DBIpp_ph_cn)) { /* '?' -> ':p1' (etc) */ + if (idx >= 99999) { + char buf[99]; + sprintf(buf, "preparse found more than 99999 '?' placeholders. Limit exceeded."); + set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse"); + return &PL_sv_undef; + } sprintf(start,":p%d", idx++); dest = start+strlen(start); } else if (PS_return(DBIpp_ph_sp)) { /* '?' -> '%s' */ - *start = '%'; - *dest++ = 's'; + *start = '%'; + *dest++ = 's'; } } else if (isDIGIT(*src)) { /* :1 */ @@ -4376,24 +4395,24 @@ style = ":1"; if (PS_return(DBIpp_ph_cn)) { /* ':1'->':p1' */ - idx = pln; - *dest++ = 'p'; - while(isDIGIT(*src)) - *dest++ = *src++; + idx = pln; + *dest++ = 'p'; + while(isDIGIT(*src)) + *dest++ = *src++; } else if (PS_return(DBIpp_ph_qm) /* ':1' -> '?' */ || PS_return(DBIpp_ph_sp) /* ':1' -> '%s' */ ) { - PS_return(DBIpp_ph_qm) ? sprintf(start,"?") : sprintf(start,"%%s"); - dest = start + strlen(start); - if (pln != idx) { - char buf[99]; - sprintf(buf, "preparse found placeholder :%d out of sequence, expected :%d", pln, idx); - set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse"); - return &PL_sv_undef; - } - while(isDIGIT(*src)) src++; - idx++; + PS_return(DBIpp_ph_qm) ? sprintf(start,"?") : sprintf(start,"%%s"); + dest = start + strlen(start); + if (pln != idx) { + char buf[99]; + sprintf(buf, "preparse found placeholder :%d out of sequence, expected :%d", pln, idx); + set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse"); + return &PL_sv_undef; + } + while(isDIGIT(*src)) src++; + idx++; } } else if (isALNUM(*src)) /* :name */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/MANIFEST new/DBI-1.650/MANIFEST --- old/DBI-1.648/MANIFEST 2026-06-04 16:03:52.000000000 +0200 +++ new/DBI-1.650/MANIFEST 2026-07-07 18:42:07.000000000 +0200 @@ -11,6 +11,7 @@ cpanfile Perl.xs Test harness (currently) for Driver.xst README.md +CONTRIBUTING.md dbd_xsh.h Prototypes for standard Driver.xst interface dbi_sql.h Definitions based on SQL CLI / ODBC (#inc'd by DBIXS.h) dbipport.h Perl portability macros (from Devel::PPort) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/META.json new/DBI-1.650/META.json --- old/DBI-1.648/META.json 2026-06-04 16:03:52.000000000 +0200 +++ new/DBI-1.650/META.json 2026-07-07 18:42:07.000000000 +0200 @@ -23,7 +23,7 @@ "build" : { "requires" : { "ExtUtils::MakeMaker" : "6.48", - "Test::Simple" : "0.90" + "Test::Simple" : "0.96" } }, "configure" : { @@ -33,6 +33,7 @@ }, "runtime" : { "requires" : { + "Module::Load" : "0.22", "perl" : "5.008001" } } @@ -52,7 +53,7 @@ "x_IRC" : "irc://irc.perl.org/#dbi", "x_MailingList" : "mailto:[email protected]"; }, - "version" : "1.648", + "version" : "1.650", "x_serialization_backend" : "JSON::PP version 4.18", "x_suggests" : { "Clone" : 0.47, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/META.yml new/DBI-1.650/META.yml --- old/DBI-1.648/META.yml 2026-06-04 16:03:52.000000000 +0200 +++ new/DBI-1.650/META.yml 2026-07-07 18:42:07.000000000 +0200 @@ -4,7 +4,7 @@ - 'DBI team ([email protected])' build_requires: ExtUtils::MakeMaker: '6.48' - Test::Simple: '0.90' + Test::Simple: '0.96' configure_requires: ExtUtils::MakeMaker: '0' dynamic_config: 1 @@ -19,6 +19,7 @@ - t - inc requires: + Module::Load: '0.22' perl: '5.008001' resources: IRC: irc://irc.perl.org/#dbi @@ -27,7 +28,7 @@ homepage: http://dbi.perl.org/ license: http://dev.perl.org/licenses/ repository: https://github.com/perl5-dbi/dbi -version: '1.648' +version: '1.650' x_serialization_backend: 'CPAN::Meta::YAML version 0.020' x_suggests: Clone: 0.47 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/Makefile.PL new/DBI-1.650/Makefile.PL --- old/DBI-1.648/Makefile.PL 2026-06-01 11:07:39.000000000 +0200 +++ new/DBI-1.650/Makefile.PL 2026-07-06 11:13:34.000000000 +0200 @@ -62,7 +62,10 @@ MIN_PERL_VERSION => "5.008001", BUILD_REQUIRES => { "ExtUtils::MakeMaker" => "6.48", - "Test::Simple" => "0.90", + "Test::Simple" => "0.96", + }, + PREREQ_PM => { + "Module::Load" => 0.22, }, META_MERGE => { resources => { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/cpanfile new/DBI-1.650/cpanfile --- old/DBI-1.648/cpanfile 2024-12-31 15:26:00.000000000 +0100 +++ new/DBI-1.650/cpanfile 2026-07-06 11:13:34.000000000 +0200 @@ -1,22 +1,23 @@ requires "XSLoader"; +requires "Module::Load" => "0.22"; -recommends "Encode" => "3.21"; +recommends "Encode" => "3.24"; -suggests "Clone" => "0.47"; +suggests "Clone" => "0.50"; suggests "DB_File"; suggests "MLDBM"; -suggests "Net::Daemon"; +suggests "Net::Daemon" => "0.52"; suggests "RPC::PlServer" => "0.2020"; suggests "SQL::Statement" => "1.414"; on "configure" => sub { - requires "ExtUtils::MakeMaker" => "6.48"; + requires "ExtUtils::MakeMaker" => "6.48"; - recommends "ExtUtils::MakeMaker" => "7.70"; + recommends "ExtUtils::MakeMaker" => "7.78"; }; on "test" => sub { - requires "Test::More" => "0.90"; + requires "Test::More" => "0.96"; - recommends "Test::More" => "1.302207"; + recommends "Test::More" => "1.302222"; }; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/dbipport.h new/DBI-1.650/dbipport.h --- old/DBI-1.648/dbipport.h 2024-12-31 15:37:02.000000000 +0100 +++ new/DBI-1.650/dbipport.h 2026-07-05 11:34:27.000000000 +0200 @@ -4,9 +4,9 @@ /* ---------------------------------------------------------------------- - dbipport.h -- Perl/Pollution/Portability Version 3.72 + dbipport.h -- Perl/Pollution/Portability Version 3.73 - Automatically created by Devel::PPPort running under perl 5.040000. + Automatically created by Devel::PPPort running under perl 5.042002. Do NOT edit this file directly! -- Edit PPPort_pm.PL and the includes in parts/inc/ instead. @@ -21,7 +21,7 @@ =head1 NAME -dbipport.h - Perl/Pollution/Portability version 3.72 +dbipport.h - Perl/Pollution/Portability version 3.73 =head1 SYNOPSIS @@ -302,6 +302,7 @@ sv_setpvf_mg() NEED_sv_setpvf_mg NEED_sv_setpvf_mg_GLOBAL sv_setpvf_mg_nocontext() NEED_sv_setpvf_mg_nocontext NEED_sv_setpvf_mg_nocontext_GLOBAL sv_unmagicext() NEED_sv_unmagicext NEED_sv_unmagicext_GLOBAL + sv_vstring_get() NEED_sv_vstring_get NEED_sv_vstring_get_GLOBAL utf8_to_uvchr_buf() NEED_utf8_to_uvchr_buf NEED_utf8_to_uvchr_buf_GLOBAL vload_module() NEED_vload_module NEED_vload_module_GLOBAL vmess() NEED_vmess NEED_vmess_GLOBAL @@ -588,7 +589,7 @@ # Disable broken TRIE-optimization BEGIN { eval '${^RE_TRIE_MAXBUF} = -1' if "$]" >= "5.009004" && "$]" <= "5.009005"} -my $VERSION = 3.72; +my $VERSION = 3.73; my %opt = ( quiet => 0, @@ -7089,6 +7090,7 @@ Perl_sqrt|5.006000|5.006000|n PERL_STACK_OFFSET_DEFINED|||piu PERL_STACK_OVERFLOW_CHECK|5.006000||Viu +PERL_STACK_REALIGN|||piu PERL_STATIC_FORCE_INLINE|5.031011||Viu PERL_STATIC_FORCE_INLINE_NO_RET|5.031011||Viu PERL_STATIC_INLINE|5.013004|5.013004|poVn @@ -9445,7 +9447,7 @@ sv_ref|5.023005|5.023005| SvREFCNT|5.003007|5.003007| SvREFCNT_dec|5.003007|5.003007| -SvREFCNT_dec_NN|5.017007|5.017007| +SvREFCNT_dec_NN|5.017007|5.017007|p SvREFCNT_IMMORTAL|5.017008||Viu SvREFCNT_inc|5.003007|5.003007|pn SvREFCNT_inc_NN|5.009004|5.003007|pn @@ -9631,11 +9633,13 @@ sv_vcatpvf_mg|5.006000|5.004000|p sv_vcatpvfn|5.004000|5.004000| sv_vcatpvfn_flags|5.017002|5.017002| -SvVOK|5.008001|5.008001| +SvVOK|5.008001|5.008001|p sv_vsetpvf|5.006000|5.004000|p sv_vsetpvf_mg|5.006000|5.004000|p sv_vsetpvfn|5.004000|5.004000| +sv_vstring_get|||p SvVSTRING_mg|5.009004|5.003007|p +SvVSTRING|||piu SvWEAKREF|5.006000||Viu SvWEAKREF_off|5.006000||Viu SvWEAKREF_on|5.006000||Viu @@ -12513,6 +12517,19 @@ #endif #endif + +/* work around a stack alignment bug in 32-bit GCC on Windows */ +#if defined(WIN32) && !defined(WIN64) && defined(__GNUC__) +#ifndef PERL_STACK_REALIGN +# define PERL_STACK_REALIGN __attribute__((force_align_arg_pointer)) +#endif + +#else +#ifndef PERL_STACK_REALIGN +# define PERL_STACK_REALIGN +#endif + +#endif #ifndef cBOOL # define cBOOL(cbool) ((cbool) ? (bool)1 : (bool)0) #endif @@ -15932,6 +15949,11 @@ (void)((PL_Sv=(SV*)(sv)) ? ++(SvREFCNT(PL_Sv)) : 0) # endif #endif + +/* not as efficient as the real thing, but it works */ +#ifndef SvREFCNT_dec_NN +# define SvREFCNT_dec_NN(sv) SvREFCNT_dec(sv) +#endif #ifndef SvREFCNT_inc_simple_void # define SvREFCNT_inc_simple_void(sv) STMT_START { if (sv) SvREFCNT(sv)++; } STMT_END #endif @@ -16595,6 +16617,49 @@ #endif #endif +#ifndef SvVSTRING +# define SvVSTRING(sv, len) (sv_vstring_get(sv, &(len))) +#endif + +#ifndef SvVOK +# define SvVOK(sv) (FALSE) +#endif + +#if !defined(sv_vstring_get) + +#if defined(NEED_sv_vstring_get) +static const char * DPPP_(my_sv_vstring_get)(pTHX_ SV * sv, STRLEN * lenp); +static +#else +extern const char * DPPP_(my_sv_vstring_get)(pTHX_ SV * sv, STRLEN * lenp); +#endif + +#if defined(NEED_sv_vstring_get) || defined(NEED_sv_vstring_get_GLOBAL) + +#ifdef sv_vstring_get +# undef sv_vstring_get +#endif +#define sv_vstring_get(a,b) DPPP_(my_sv_vstring_get)(aTHX_ a,b) +#define Perl_sv_vstring_get DPPP_(my_sv_vstring_get) + + +const char * +DPPP_(my_sv_vstring_get)(pTHX_ SV *sv, STRLEN *lenp) +{ +#ifdef SvVSTRING_mg + MAGIC *mg = SvVSTRING_mg(sv); + if (!mg) return NULL; + + if (lenp) *lenp = mg->mg_len; + return mg->mg_ptr; +#else + return NULL; +#endif +} + +#endif + +#endif #ifdef USE_ITHREADS #ifndef CopFILE diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/dbixs_rev.h new/DBI-1.650/dbixs_rev.h --- old/DBI-1.648/dbixs_rev.h 2026-06-04 16:02:44.000000000 +0200 +++ new/DBI-1.650/dbixs_rev.h 2026-07-07 18:41:07.000000000 +0200 @@ -1,4 +1,4 @@ -/* Thu Jun 4 16:02:44 2026 */ +/* Tue Jul 7 18:41:07 2026 */ #define DBIXS_RELEASE 1 -#define DBIXS_VERSION 648 -#define DBIXS_REVISION 1746 +#define DBIXS_VERSION 650 +#define DBIXS_REVISION 1771 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/lib/DBD/File/Roadmap.pod new/DBI-1.650/lib/DBD/File/Roadmap.pod --- old/DBI-1.648/lib/DBD/File/Roadmap.pod 2013-04-05 08:08:36.000000000 +0200 +++ new/DBI-1.650/lib/DBD/File/Roadmap.pod 2026-07-04 16:26:36.000000000 +0200 @@ -152,7 +152,7 @@ =head1 RESOURCES AND CONTRIBUTIONS -See L<http://dbi.perl.org/contributing> for I<how you can help>. +See F<CONTRIBUTING.md> for I<how you can help>. If your company has benefited from DBI, please consider if it could make a donation to The Perl Foundation "DBI Development" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/lib/DBD/File.pm new/DBI-1.650/lib/DBD/File.pm --- old/DBI-1.648/lib/DBD/File.pm 2026-05-29 11:47:08.000000000 +0200 +++ new/DBI-1.650/lib/DBD/File.pm 2026-07-05 13:53:14.000000000 +0200 @@ -630,8 +630,10 @@ # Note this triggers only when *used*, not at definition time # $dbh->{csv_tables}{foo}{file} = "/out/side/scope/foo.csv"; # OK # $dbh->do ("create table foo (c char)"); # FAIL - { my @sd = map { Cwd::abs_path ($_) } $meta->{f_dir}, @{$meta->{f_dir_search} || []}; - unless (List::Util::first { $_ eq $searchdir } @sd) { + if ($searchdir) { + my $sd = Cwd::abs_path ($searchdir); + my @sd = map { Cwd::abs_path ($_) } $meta->{f_dir}, @{$meta->{f_dir_search} || []}; + unless (List::Util::first { $_ eq $sd } @sd) { croak "Using data files in $searchdir is unsafe and not allowed.\nUse f_dir or f_dir_search.\n"; } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/lib/DBI/Changes.pm new/DBI-1.650/lib/DBI/Changes.pm --- old/DBI-1.648/lib/DBI/Changes.pm 2026-06-04 15:46:45.000000000 +0200 +++ new/DBI-1.650/lib/DBI/Changes.pm 2026-07-07 16:22:56.000000000 +0200 @@ -12,6 +12,42 @@ =encoding UTF-8 +=head2 Changes in DBI 1.650 - 06 Jul 2026 + +=over 2 + +=item * + +Set a hard limit of 99999 on '?' placeholders (CVE-2026-14739) + +=item * + +Fix out-of-bounds read in preparse of SQL that starts with a comment (CVE-2026-14740) + +=item * + +Fix code injection via Profile DSN attribute or DBI_PROFILE variable (CVE-2026-14380) + +=item * + +Update dbipport.h to Devel::PPPort-3.73 + +=item * + +Require Test::More 0.96 (tests will otherwise fail on pristine perl-5.12) + +=back + +=head2 Changes in DBI 1.649 - 22 Jun 2026 + +=over 2 + +=item * + +Extra Cwd::abs_path required for Windows + +=back + =head2 Changes in DBI 1.648 - 04 Jun 2026 =over 2 @@ -42,7 +78,7 @@ =item * -Fix possible buffer overflow in preparse +Fix possible buffer overflow in preparse (CVE-2026-10879) =item * diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/lib/DBI/Profile.pm new/DBI-1.650/lib/DBI/Profile.pm --- old/DBI-1.648/lib/DBI/Profile.pm 2025-01-17 10:56:44.000000000 +0100 +++ new/DBI-1.650/lib/DBI/Profile.pm 2026-07-04 14:28:00.000000000 +0200 @@ -679,6 +679,7 @@ use Exporter (); use UNIVERSAL (); use Carp; +use Module::Load (); use DBI qw(dbi_time dbi_profile dbi_profile_merge_nodes dbi_profile_merge); @@ -758,7 +759,9 @@ } } - eval "require $package" if $package; # silently ignores errors + eval { + Module::Load::load $package if $package; # silently ignores errors + }; $package ||= $class; return $package->new(Path => \@Path, @args); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.648/t/40profile.t new/DBI-1.650/t/40profile.t --- old/DBI-1.648/t/40profile.t 2025-01-17 10:49:51.000000000 +0100 +++ new/DBI-1.650/t/40profile.t 2026-07-06 11:13:34.000000000 +0200 @@ -31,7 +31,7 @@ if $Config{osvers} =~ /xen/ # eg 2.6.18-4-xen-amd64 and $ENV{AUTOMATED_TESTING}; - plan tests => 60; + plan tests => 61; } $Data::Dumper::Indent = 1; @@ -458,8 +458,51 @@ 'merged time foo/bar'); is($total_time, 2.93, 'merged nodes foo/bar time'); +subtest "CVE-2026-14380" => sub { + + plan tests => 3; + + { + my $marker = sprintf('dbi-test-payload-%1.6f-%u-%u-%u', $], time, $$, 1); + local $ENV{DBI_PROFILE} = payload_for($marker); + my $dbh = eval { + DBI->connect("dbi:Sponge:", "", "", { RaiseError => 0 }) + }; + ok !( -e "/tmp/$marker" ), "ENV DBI_PROFILE payload"; + unlink "/tmp/$marker" if -e "/tmp/$marker"; + } + + { + my $marker = sprintf('dbi-test-payload-%1.6f-%u-%u-%u', $], time, $$, 2); + my $dbh = DBI->connect("dbi:Sponge:", "", "", { RaiseError => 0 }); + eval { + $dbh->{Profile} = payload_for($marker); + }; + ok !( -e "/tmp/$marker" ), "Set Profile payload"; + unlink "/tmp/$marker" if -e "/tmp/$marker"; + } + + { + my $marker = sprintf('dbi-test-payload-%1.6f-%u-%u-%u', $], time, $$, 3); + my $payload = payload_for($marker); + my $dsn = "dbi:Sponge(Profile=>$payload):"; + my $dbh = eval { + DBI->connect($dsn, "", "", { RaiseError => 0 }) + }; + ok !( -e "/tmp/$marker" ), "DSN payload"; + unlink "/tmp/$marker" if -e "/tmp/$marker"; + } + +}; + exit 0; +sub payload_for { + my ($marker) = @_; + # Single-quoted q{...} so \x2f is literal backslash-x-2-f for split; + # the inner qq(...) re-interprets \x2f = / at eval-time. + return qq{2/system(qq(touch \\x2ftmp\\x2f$marker))}; +} sub sanitize_tree { my $data = shift; ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.GKMPAt/_old 2026-07-09 22:18:37.688591734 +0200 +++ /var/tmp/diff_new_pack.GKMPAt/_new 2026-07-09 22:18:37.692591871 +0200 @@ -1,6 +1,6 @@ -mtime: 1781867574 -commit: 4f3462514de002ae278bc37504cda55f5f275a7ea307c189a0ebd54824345e94 +mtime: 1783500980 +commit: 1bc4705c359559d80313214602116acb9f2c015b0b1ab9d5e9c9172e8cdf14de url: https://src.opensuse.org/perl/perl-DBI -revision: 4f3462514de002ae278bc37504cda55f5f275a7ea307c189a0ebd54824345e94 +revision: 1bc4705c359559d80313214602116acb9f2c015b0b1ab9d5e9c9172e8cdf14de projectscmsync: https://src.opensuse.org/perl/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-07-08 10:56:20.000000000 +0200 @@ -0,0 +1 @@ +.osc
