Skip to content

Commit 9cbce1b

Browse files
archana25-msarchana25-ms
authored
[MEDIUM] Patch gdb for CVE-2021-32256 & CVE-2025-5244 (microsoft#13814)
1 parent 1085d83 commit 9cbce1b

File tree

4 files changed

+245
-1
lines changed

4 files changed

+245
-1
lines changed

‎SPECS/gdb/CVE-2021-32256.patch‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
From c033e0e1371416007b67c5f0111835ead34d921f Mon Sep 17 00:00:00 2001
2+
From: archana25-ms <[email protected]>
3+
Date: Thu, 15 May 2025 00:39:58 +0000
4+
Subject: [PATCH] Address CVE-2021-32256
5+
Upstream Patch Reference: https://gcc.gnu.org/pipermail/gcc-patches/attachments/20220324/63021510/attachment.bin
6+
7+
---
8+
libiberty/rust-demangle.c | 29 ++++++++++++++++++++---------
9+
1 file changed, 20 insertions(+), 9 deletions(-)
10+
11+
diff --git a/libiberty/rust-demangle.c b/libiberty/rust-demangle.c
12+
index 449941b..13c3e7b 100644
13+
--- a/libiberty/rust-demangle.c
14+
+++ b/libiberty/rust-demangle.c
15+
@@ -120,7 +120,7 @@ parse_integer_62 (struct rust_demangler *rdm)
16+
return 0;
17+
18+
x = 0;
19+
- while (!eat (rdm, '_'))
20+
+ while (!eat (rdm, '_') && !rdm->errored)
21+
{
22+
c = next (rdm);
23+
x *= 62;
24+
@@ -1114,6 +1114,15 @@ demangle_const (struct rust_demangler *rdm)
25+
if (rdm->errored)
26+
return;
27+
28+
+ if (rdm->recursion != RUST_NO_RECURSION_LIMIT)
29+
+ {
30+
+ ++ rdm->recursion;
31+
+ if (rdm->recursion > RUST_MAX_RECURSION_COUNT)
32+
+ /* FIXME: There ought to be a way to report
33+
+ that the recursion limit has been reached. */
34+
+ goto fail_return;
35+
+ }
36+
+
37+
if (eat (rdm, 'B'))
38+
{
39+
backref = parse_integer_62 (rdm);
40+
@@ -1124,7 +1133,7 @@ demangle_const (struct rust_demangler *rdm)
41+
demangle_const (rdm);
42+
rdm->next = old_next;
43+
}
44+
- return;
45+
+ goto pass_return;
46+
}
47+
48+
ty_tag = next (rdm);
49+
@@ -1133,7 +1142,7 @@ demangle_const (struct rust_demangler *rdm)
50+
/* Placeholder. */
51+
case 'p':
52+
PRINT ("_");
53+
- return;
54+
+ goto pass_return;
55+
56+
/* Unsigned integer types. */
57+
case 'h':
58+
@@ -1166,18 +1175,21 @@ demangle_const (struct rust_demangler *rdm)
59+
break;
60+
61+
default:
62+
- rdm->errored = 1;
63+
- return;
64+
+ goto fail_return;
65+
}
66+
67+
- if (rdm->errored)
68+
- return;
69+
-
70+
- if (rdm->verbose)
71+
+ if (!rdm->errored && rdm->verbose)
72+
{
73+
PRINT (": ");
74+
PRINT (basic_type (ty_tag));
75+
}
76+
+
77+
+ goto pass_return;
78+
+ fail_return:
79+
+ rdm->errored = 1;
80+
+ pass_return:
81+
+ if (rdm->recursion != RUST_NO_RECURSION_LIMIT)
82+
+ -- rdm->recursion;
83+
}
84+
85+
static void
86+
--
87+
2.45.3
88+

‎SPECS/gdb/CVE-2025-5244.patch‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
From 66b52f5416af51d55fc771f8018ab6f8e14626e6 Mon Sep 17 00:00:00 2001
2+
From: archana25-ms <[email protected]>
3+
Date: Sun, 8 Jun 2025 07:05:51 +0000
4+
Subject: [PATCH] Address CVE-2025-5244
5+
Upstream Patch Reference: https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=d1458933830456e54223d9fc61f0d9b3a19256f5
6+
7+
---
8+
bfd/elflink.c | 3 ++-
9+
1 file changed, 2 insertions(+), 1 deletion(-)
10+
11+
diff --git a/bfd/elflink.c b/bfd/elflink.c
12+
index 9a05208..a51a828 100644
13+
--- a/bfd/elflink.c
14+
+++ b/bfd/elflink.c
15+
@@ -13797,7 +13797,8 @@ elf_gc_sweep (bfd *abfd, struct bfd_link_info *info)
16+
if (o->flags & SEC_GROUP)
17+
{
18+
asection *first = elf_next_in_group (o);
19+
- o->gc_mark = first->gc_mark;
20+
+ if (first != NULL)
21+
+ o->gc_mark = first->gc_mark;
22+
}
23+
24+
if (o->gc_mark)
25+
--
26+
2.45.3
27+

‎SPECS/gdb/fix-infinite-recursion.patch‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
From f10bec5ffa487ad3033ed5f38cfd0fc7d696deab Mon Sep 17 00:00:00 2001
2+
From: Nick Clifton <[email protected]>
3+
Date: Mon, 31 Jan 2022 14:28:42 +0000
4+
Subject: libiberty: Fix infinite recursion in rust demangler.
5+
6+
libiberty/
7+
PR demangler/98886
8+
PR demangler/99935
9+
* rust-demangle.c (struct rust_demangler): Add a recursion
10+
counter.
11+
(demangle_path): Increment/decrement the recursion counter upon
12+
entry and exit. Fail if the counter exceeds a fixed limit.
13+
(demangle_type): Likewise.
14+
(rust_demangle_callback): Initialise the recursion counter,
15+
disabling if requested by the option flags.
16+
---
17+
libiberty/rust-demangle.c | 47 +++++++++++++++++++++++++++++++++++++++++------
18+
1 file changed, 41 insertions(+), 6 deletions(-)
19+
20+
diff --git a/libiberty/rust-demangle.c b/libiberty/rust-demangle.c
21+
index 18c760491bdc..3b24d63892a9 100644
22+
--- a/libiberty/rust-demangle.c
23+
+++ b/libiberty/rust-demangle.c
24+
@@ -74,6 +74,12 @@ struct rust_demangler
25+
/* Rust mangling version, with legacy mangling being -1. */
26+
int version;
27+
28+
+ /* Recursion depth. */
29+
+ unsigned int recursion;
30+
+ /* Maximum number of times demangle_path may be called recursively. */
31+
+#define RUST_MAX_RECURSION_COUNT 1024
32+
+#define RUST_NO_RECURSION_LIMIT ((unsigned int) -1)
33+
+
34+
uint64_t bound_lifetime_depth;
35+
};
36+
37+
@@ -671,6 +677,15 @@ demangle_path (struct rust_demangler *rdm, int in_value)
38+
if (rdm->errored)
39+
return;
40+
41+
+ if (rdm->recursion != RUST_NO_RECURSION_LIMIT)
42+
+ {
43+
+ ++ rdm->recursion;
44+
+ if (rdm->recursion > RUST_MAX_RECURSION_COUNT)
45+
+ /* FIXME: There ought to be a way to report
46+
+ that the recursion limit has been reached. */
47+
+ goto fail_return;
48+
+ }
49+
+
50+
switch (tag = next (rdm))
51+
{
52+
case 'C':
53+
@@ -688,10 +703,7 @@ demangle_path (struct rust_demangler *rdm, int in_value)
54+
case 'N':
55+
ns = next (rdm);
56+
if (!ISLOWER (ns) && !ISUPPER (ns))
57+
- {
58+
- rdm->errored = 1;
59+
- return;
60+
- }
61+
+ goto fail_return;
62+
63+
demangle_path (rdm, in_value);
64+
65+
@@ -776,9 +788,15 @@ demangle_path (struct rust_demangler *rdm, int in_value)
66+
}
67+
break;
68+
default:
69+
- rdm->errored = 1;
70+
- return;
71+
+ goto fail_return;
72+
}
73+
+ goto pass_return;
74+
+
75+
+ fail_return:
76+
+ rdm->errored = 1;
77+
+ pass_return:
78+
+ if (rdm->recursion != RUST_NO_RECURSION_LIMIT)
79+
+ -- rdm->recursion;
80+
}
81+
82+
static void
83+
@@ -870,6 +888,19 @@ demangle_type (struct rust_demangler *rdm)
84+
return;
85+
}
86+
87+
+ if (rdm->recursion != RUST_NO_RECURSION_LIMIT)
88+
+ {
89+
+ ++ rdm->recursion;
90+
+ if (rdm->recursion > RUST_MAX_RECURSION_COUNT)
91+
+ /* FIXME: There ought to be a way to report
92+
+ that the recursion limit has been reached. */
93+
+ {
94+
+ rdm->errored = 1;
95+
+ -- rdm->recursion;
96+
+ return;
97+
+ }
98+
+ }
99+
+
100+
switch (tag)
101+
{
102+
case 'R':
103+
@@ -1030,6 +1061,9 @@ demangle_type (struct rust_demangler *rdm)
104+
rdm->next--;
105+
demangle_path (rdm, 0);
106+
}
107+
+
108+
+ if (rdm->recursion != RUST_NO_RECURSION_LIMIT)
109+
+ -- rdm->recursion;
110+
}
111+
112+
/* A trait in a trait object may have some "existential projections"
113+
@@ -1320,6 +1354,7 @@ rust_demangle_callback (const char *mangled, int options,
114+
rdm.skipping_printing = 0;
115+
rdm.verbose = (options & DMGL_VERBOSE) != 0;
116+
rdm.version = 0;
117+
+ rdm.recursion = (options & DMGL_NO_RECURSE_LIMIT) ? RUST_NO_RECURSION_LIMIT : 0;
118+
rdm.bound_lifetime_depth = 0;
119+
120+
/* Rust symbols always start with _R (v0) or _ZN (legacy). */
121+
--
122+
cgit
123+

‎SPECS/gdb/gdb.spec‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: C debugger
22
Name: gdb
33
Version: 11.2
4-
Release: 8%{?dist}
4+
Release: 9%{?dist}
55
License: GPLv2+
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -20,6 +20,9 @@ Patch8: CVE-2022-47696.patch
2020
Patch9: CVE-2025-7546.patch
2121
Patch10: CVE-2025-11082.patch
2222
Patch11: CVE-2025-11083.patch
23+
Patch12: CVE-2021-32256.patch
24+
Patch13: fix-infinite-recursion.patch
25+
Patch14: CVE-2025-5244.patch
2326
BuildRequires: expat-devel
2427
BuildRequires: gcc-c++
2528
BuildRequires: gcc-gfortran
@@ -104,6 +107,9 @@ rm -rvf libctf/testsuite
104107
%{_mandir}/*/*
105108

106109
%changelog
110+
* Mon Oct 27 2025 Archana Shettigar <[email protected]> - 11.2-9
111+
- Patch CVE-2021-32256 & CVE-2025-5244 using an upstream patch
112+
107113
* Fri Oct 03 2025 Azure Linux Security Servicing Account <[email protected]> - 11.2-8
108114
- Patch for CVE-2025-11083, CVE-2025-11082
109115

0 commit comments

Comments
 (0)