[Midnightbsd-cvs] [MidnightBSD/mports] f0ed1a: databases/p5-DBD-Pg: update to 3.21.1

[Lucas Holt]

  Branch: refs/heads/databases/p5-DBD-Pg
  Home:   https://github.com/MidnightBSD/mports
  Commit: f0ed1aa565249cdace89ee35ce5fc1006749c29e
      https://github.com/MidnightBSD/mports/commit/f0ed1aa565249cdace89ee35ce5fc1006749c29e
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-23 (Sun, 23 Aug 2026)

  Changed paths:
    M databases/p5-DBD-Pg/Makefile
    M databases/p5-DBD-Pg/distinfo
    M databases/p5-DBD-Pg/files/patch-Makefile.PL

  Log Message:
  -----------
  databases/p5-DBD-Pg: update to 3.21.1

Upstream fixes an incorrect allocation in quote_float() along with
related fixes in _dequote_bytea_hex() and pg_destringify_array().

The quote_float() bug is CVE-2026-78183: for the special literals NaN,
Inf, +Inf, -Inf, Infinity, +Infinity and -Infinity the function emitted
the literal wrapped in single quotes plus NUL (length + 3 bytes) while
allocating only length + 1, overflowing the heap buffer by two bytes.
It was reachable through $dbh->quote($val, DBI::SQL_NUMERIC).

The regression was introduced in 3.21.0 by the quote.c rewrite, so
mports was never vulnerable at 3.20.2.  This update is for currency and
to stay ahead of the fixed branch.

Regenerate patch-Makefile.PL: upstream reworked the INC line to use
qq{} quoting, so the first hunk no longer applied.  The patch keeps its
original purpose of appending $comp_opts to INC rather than letting
CCFLAGS clobber perl's own compiler flags.

Set NO_TEST: 3.21.1 calls plan() twice in t/03dbmethod.t,
t/10_pg_error_field.t and t/30unicode.t when no PostgreSQL server is
reachable, so those files die rather than skipping.

AI-Assisted-by: Claude Opus 5 (1M context) <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications