[pkgsrc/pkgsrc-2021Q3]: pkgsrc/databases/p5-DBI Pullup ticket #6515 - request...

[tm <tm%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/8cc342cf2006
branches:  pkgsrc-2021Q3
changeset: 768241:8cc342cf2006
user:      tm <tm%pkgsrc.org@localhost>
date:      Sat Oct 16 17:51:39 2021 +0000

description:
Pullup ticket #6515 - requested by wiz
databases/p5-DBI: security fix

Revisions pulled up:
- databases/p5-DBI/Makefile                                     1.87
- databases/p5-DBI/distinfo                                     1.54
- databases/p5-DBI/patches/patch-lib_DBD_File.pm                1.1

---
   Module Name: pkgsrc
   Committed By:        wiz
   Date:                Thu Oct 14 07:08:58 UTC 2021

   Modified Files:
        pkgsrc/databases/p5-DBI: Makefile distinfo
   Added Files:
        pkgsrc/databases/p5-DBI/patches: patch-lib_DBD_File.pm

   Log Message:
   p5-DBI: fix CVE-2014-10402

   Bump PKGREVISION

diffstat:

 databases/p5-DBI/Makefile                      |   4 +-
 databases/p5-DBI/distinfo                      |   3 +-
 databases/p5-DBI/patches/patch-lib_DBD_File.pm |  28 ++++++++++++++++++++++++++
 3 files changed, 32 insertions(+), 3 deletions(-)

diffs (58 lines):

diff -r bfaa25457e55 -r 8cc342cf2006 databases/p5-DBI/Makefile
--- a/databases/p5-DBI/Makefile Sat Oct 16 17:46:43 2021 +0000
+++ b/databases/p5-DBI/Makefile Sat Oct 16 17:51:39 2021 +0000
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.86 2021/05/24 19:49:34 wiz Exp $
+# $NetBSD: Makefile,v 1.86.4.1 2021/10/16 17:51:39 tm Exp $
 
 DISTNAME=      DBI-1.643
 PKGNAME=       p5-${DISTNAME}
-PKGREVISION=   2
+PKGREVISION=   3
 CATEGORIES=    databases perl5
 MASTER_SITES=  ${MASTER_SITE_PERL_CPAN:=DBI/}
 
diff -r bfaa25457e55 -r 8cc342cf2006 databases/p5-DBI/distinfo
--- a/databases/p5-DBI/distinfo Sat Oct 16 17:46:43 2021 +0000
+++ b/databases/p5-DBI/distinfo Sat Oct 16 17:51:39 2021 +0000
@@ -1,6 +1,7 @@
-$NetBSD: distinfo,v 1.52 2020/05/17 09:12:01 wen Exp $
+$NetBSD: distinfo,v 1.52.12.1 2021/10/16 17:51:39 tm Exp $
 
 SHA1 (DBI-1.643.tar.gz) = fdbe7a86873eed196be5f9753aabed5c1e22f2cb
 RMD160 (DBI-1.643.tar.gz) = c944a9568c4aa0c8f5e936bba47d9ee55d16b6cb
 SHA512 (DBI-1.643.tar.gz) = 03812f3eb1e43c8290dadb8cb14bbced9ec6e237228ea2a2ba91f22e52143906a91a7e82945dab30b1d1b9fc925073721111adafd9a09fac070808ab88f908b8
 Size (DBI-1.643.tar.gz) = 612372 bytes
+SHA1 (patch-lib_DBD_File.pm) = e268b5f59b4474b8c2f5d72891c31f5d0f53c0c0
diff -r bfaa25457e55 -r 8cc342cf2006 databases/p5-DBI/patches/patch-lib_DBD_File.pm
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/databases/p5-DBI/patches/patch-lib_DBD_File.pm    Sat Oct 16 17:51:39 2021 +0000
@@ -0,0 +1,28 @@
+$NetBSD: patch-lib_DBD_File.pm,v 1.1.2.2 2021/10/16 17:51:39 tm Exp $
+
+Fix CVE-2014-10402
+https://github.com/perl5-dbi/dbi/pull/93/commits/19d0fb169eed475e1c053e99036b8668625cfa94
+
+--- lib/DBD/File.pm.orig       2016-11-09 10:11:37.000000000 +0000
++++ lib/DBD/File.pm
+@@ -109,7 +109,11 @@ sub connect
+     # We do not (yet) care about conflicting attributes here
+     # my $dbh = DBI->connect ("dbi:CSV:f_dir=test", undef, undef, { f_dir => "text" });
+     # will test here that both test and text should exist
+-    if (my $attr_hash = (DBI->parse_dsn ($dbname))[3]) {
++    #
++    # Parsing on our own similar to parse_dsn to find attributes in 'dbname' parameter.
++    if ($dbname) {
++      my @attrs = split /;/ => $dbname;
++      my $attr_hash = { map { split /\s*=>?\s*|\s*,\s*/, $_} @attrs };
+       if (defined $attr_hash->{f_dir} && ! -d $attr_hash->{f_dir}) {
+           my $msg = "No such directory '$attr_hash->{f_dir}";
+           $drh->set_err (2, $msg);
+@@ -120,7 +124,6 @@ sub connect
+     if ($attr and defined $attr->{f_dir} && ! -d $attr->{f_dir}) {
+       my $msg = "No such directory '$attr->{f_dir}";
+       $drh->set_err (2, $msg);
+-      $attr->{RaiseError} and croak $msg;
+       return;
+       }
+