Skip to content

GHSA-rwhc-hhmv-cjvg on CTRL-OS 26.05

Aliases: GHSA-rwhc-hhmv-cjvg, CVE-2026-60082

Packages: perlPackages.DBI

Status: Plausible

Advisory Information

The DBI XS row-buffer helper _set_fbav copies a source row into the statement handle's field-buffer array. When the source row has more elements than the handle's declared field count and the handle has zero fields, the grow branch runs for(i=dst_fields-1; i < src_fields; ++i) sv_setsv(AvARRAY(dst_av)[i], ...) at DBI.xs:5224 with dst_fields == 0, so i starts at -1 and the code indexes AvARRAY(dst_av)[-1] — one slot before the array (CWE-125). Under a normal allocator this reads a garbage SV* and crashes in sv_setsv; an ASAN build reports a heap-buffer-overflow READ of size 8.

Trigger: a caller supplies zero-column metadata and a non-empty row. DBD::Sponge->prepare("...", { NAME => [], rows => [[...]] }) sets NUM_OF_FIELDS to 0, and the first fetchrow_arrayref calls _set_fbav (Sponge.pm:197). More generally, any Perl DBD (or a malicious DBI::Gofer / ProxyServer peer supplying inconsistent Sponge-style metadata and rows) reaches the same site.

Impact is a memory-safety fault — process crash on stock builds, out-of-bounds read under hardening. Attacker reach is narrow (the caller must control both the field metadata and the row width; ordinary SQL does not reach it), hence low severity, but it is reachable through the public row-buffer API.

Fix direction: reject the inconsistent call — when a non-empty row is set against a zero-field buffer, croak rather than resize. If the resize path is retained, only the genuinely-new slots should be initialised (start at dst_fields, not dst_fields-1) and dst_fields must be updated for the subsequent copy; note the grow branch currently also leaves dst_fields stale. A loop-start clamp alone does not suffice — the whole zero-field resize path needs review.

Updates

2026-07-14 17:14 CEST

Metadata changes:

  • Status for package perlPackages.DBI: “Plausible”

(Amended on: 2026-07-14 17:15 CEST)

2026-07-14 16:16 CEST

Metadata changes:

  • Status for package perlPackages.DBI: “New”