GHSA-35f4-f8m9-w8xg on CTRL-OS 26.05

Aliases: GHSA-35f4-f8m9-w8xg, CVE-2026-14740

Packages: perlPackages.DBI

Status: Plausible

Advisory Information

DBI's XS preparse() normalises SQL across placeholder/comment styles into a freshly allocated output buffer. When an initial line comment (-- ... or # ...) is accepted for deletion, at the comment terminator the code runs src += (src != '\n' || (dest-1)=='\n') ? 1 : 0 at DBI.xs:4238 while dest is still at the start of the output buffer — nothing has been emitted yet — so *(dest-1) reads one byte before the newly allocated PV (CWE-125). On a normal allocator the stray byte is read silently; under a hardened/ASAN build it is a heap-buffer-overflow READ of size 1.

Trigger: an input whose first token is a deletable line comment, e.g. "-- x\n" with accept flag DBIpp_cm_dd, or "# x\n" with DBIpp_cm_hs, and no leading text. preparse() is a public method exposed for DBD drivers and callers that normalise SQL across placeholder styles, so the residual trigger is a driver or application passing attacker-influenced SQL through preparse().

Impact is a one-byte out-of-bounds read: an abort on ASAN/hardened builds and possible nondeterministic newline retention on normal builds. This is a distinct, lower-impact defect from the preparse() write overflow already assigned https://github.com/advisories/GHSA-c7xw-cj86-m724 (different line and mechanism; independently fixable), and warrants separate handling.

Fix: guard the previous-byte check so it is only evaluated when dest > SvPVX(new_stmt_sv). One-line change at DBI.xs:4238; verified below.

Updates

2026-07-10 17:42 CEST

Metadata changes:

• Status for package perlPackages.DBI: “Plausible”

(Amended on: 2026-07-10 17:51 CEST)

2026-07-08 15:59 CEST

Metadata changes:

• Status for package perlPackages.DBI: “New”