Skip to content

Commit 30579df

Browse files
jslobodzianjslobodzian
committed
Merge branch '3.0-dev' into 3.0
2 parents ebd28cb + d9e36f8 commit 30579df

15 files changed

+959
-15
lines changed

‎SPECS/binutils/CVE-2025-0840.patch

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
From e692412cf74604829a21a7a23857a772d2197788 Mon Sep 17 00:00:00 2001
2+
From: Sudipta Pandit <[email protected]>
3+
Date: Fri, 7 Feb 2025 01:57:06 +0530
4+
Subject: [PATCH] Backport fix for CVE-2025-0840
5+
6+
Reference: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=baac6c221e9d69335bf41366a1c7d87d8ab2f893
7+
8+
---
9+
binutils/objdump.c | 10 ++++++----
10+
1 file changed, 6 insertions(+), 4 deletions(-)
11+
12+
diff --git a/binutils/objdump.c b/binutils/objdump.c
13+
index a35982ea..2efbf4b0 100644
14+
--- a/binutils/objdump.c
15+
+++ b/binutils/objdump.c
16+
@@ -116,7 +116,8 @@ static bool disassemble_all; /* -D */
17+
static int disassemble_zeroes; /* --disassemble-zeroes */
18+
static bool formats_info; /* -i */
19+
int wide_output; /* -w */
20+
-static int insn_width; /* --insn-width */
21+
+#define MAX_INSN_WIDTH 49
22+
+static unsigned long insn_width; /* --insn-width */
23+
static bfd_vma start_address = (bfd_vma) -1; /* --start-address */
24+
static bfd_vma stop_address = (bfd_vma) -1; /* --stop-address */
25+
static int dump_debugging; /* --debugging */
26+
@@ -3315,7 +3316,7 @@ disassemble_bytes (struct disassemble_info *inf,
27+
}
28+
else
29+
{
30+
- char buf[50];
31+
+ char buf[MAX_INSN_WIDTH + 1];
32+
unsigned int bpc = 0;
33+
unsigned int pb = 0;
34+
35+
@@ -5976,8 +5977,9 @@ main (int argc, char **argv)
36+
break;
37+
case OPTION_INSN_WIDTH:
38+
insn_width = strtoul (optarg, NULL, 0);
39+
- if (insn_width <= 0)
40+
- fatal (_("error: instruction width must be positive"));
41+
+ if (insn_width - 1 >= MAX_INSN_WIDTH)
42+
+ fatal (_("error: instruction width must be in the range 1 to "
43+
+ XSTRING (MAX_INSN_WIDTH)));
44+
break;
45+
case OPTION_INLINES:
46+
unwind_inlines = true;
47+
--
48+
2.34.1
49+

‎SPECS/binutils/CVE-2025-1176.patch

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
From f9978defb6fab0bd8583942d97c112b0932ac814 Mon Sep 17 00:00:00 2001
2+
From: Nick Clifton <[email protected]>
3+
Date: Wed, 5 Feb 2025 11:15:11 +0000
4+
Subject: [PATCH] Prevent illegal memory access when indexing into the
5+
sym_hashes array of the elf bfd cookie structure.
6+
7+
PR 32636
8+
9+
Source: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f9978defb6fab0bd8583942d97c112b0932ac814
10+
---
11+
bfd/elflink.c | 90 +++++++++++++++++++++++++--------------------------
12+
1 file changed, 45 insertions(+), 45 deletions(-)
13+
14+
diff --git a/bfd/elflink.c b/bfd/elflink.c
15+
index 9a052082..9acfe8b8 100644
16+
--- a/bfd/elflink.c
17+
+++ b/bfd/elflink.c
18+
@@ -62,22 +62,37 @@ struct elf_find_verdep_info
19+
static bool _bfd_elf_fix_symbol_flags
20+
(struct elf_link_hash_entry *, struct elf_info_failed *);
21+
22+
-asection *
23+
-_bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
24+
- unsigned long r_symndx,
25+
- bool discard)
26+
+static struct elf_link_hash_entry *
27+
+get_ext_sym_hash (struct elf_reloc_cookie *cookie, unsigned long r_symndx)
28+
{
29+
- if (r_symndx >= cookie->locsymcount
30+
- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
31+
- {
32+
- struct elf_link_hash_entry *h;
33+
+ struct elf_link_hash_entry *h = NULL;
34+
35+
+ if ((r_symndx >= cookie->locsymcount
36+
+ || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
37+
+ /* Guard against corrupt input. See PR 32636 for an example. */
38+
+ && r_symndx >= cookie->extsymoff)
39+
+ {
40+
h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
41+
42+
while (h->root.type == bfd_link_hash_indirect
43+
|| h->root.type == bfd_link_hash_warning)
44+
h = (struct elf_link_hash_entry *) h->root.u.i.link;
45+
+ }
46+
+
47+
+ return h;
48+
+}
49+
50+
+asection *
51+
+_bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
52+
+ unsigned long r_symndx,
53+
+ bool discard)
54+
+{
55+
+ struct elf_link_hash_entry *h;
56+
+
57+
+ h = get_ext_sym_hash (cookie, r_symndx);
58+
+
59+
+ if (h != NULL)
60+
+ {
61+
if ((h->root.type == bfd_link_hash_defined
62+
|| h->root.type == bfd_link_hash_defweak)
63+
&& discarded_section (h->root.u.def.section))
64+
@@ -85,21 +100,20 @@ _bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
65+
else
66+
return NULL;
67+
}
68+
- else
69+
- {
70+
- /* It's not a relocation against a global symbol,
71+
- but it could be a relocation against a local
72+
- symbol for a discarded section. */
73+
- asection *isec;
74+
- Elf_Internal_Sym *isym;
75+
76+
- /* Need to: get the symbol; get the section. */
77+
- isym = &cookie->locsyms[r_symndx];
78+
- isec = bfd_section_from_elf_index (cookie->abfd, isym->st_shndx);
79+
- if (isec != NULL
80+
- && discard ? discarded_section (isec) : 1)
81+
- return isec;
82+
- }
83+
+ /* It's not a relocation against a global symbol,
84+
+ but it could be a relocation against a local
85+
+ symbol for a discarded section. */
86+
+ asection *isec;
87+
+ Elf_Internal_Sym *isym;
88+
+
89+
+ /* Need to: get the symbol; get the section. */
90+
+ isym = &cookie->locsyms[r_symndx];
91+
+ isec = bfd_section_from_elf_index (cookie->abfd, isym->st_shndx);
92+
+ if (isec != NULL
93+
+ && discard ? discarded_section (isec) : 1)
94+
+ return isec;
95+
+
96+
return NULL;
97+
}
98+
99+
@@ -13442,22 +13456,12 @@ _bfd_elf_gc_mark_rsec (struct bfd_link_info *info, asection *sec,
100+
if (r_symndx == STN_UNDEF)
101+
return NULL;
102+
103+
- if (r_symndx >= cookie->locsymcount
104+
- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
105+
+ h = get_ext_sym_hash (cookie, r_symndx);
106+
+
107+
+ if (h != NULL)
108+
{
109+
bool was_marked;
110+
111+
- h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
112+
- if (h == NULL)
113+
- {
114+
- info->callbacks->einfo (_("%F%P: corrupt input: %pB\n"),
115+
- sec->owner);
116+
- return NULL;
117+
- }
118+
- while (h->root.type == bfd_link_hash_indirect
119+
- || h->root.type == bfd_link_hash_warning)
120+
- h = (struct elf_link_hash_entry *) h->root.u.i.link;
121+
-
122+
was_marked = h->mark;
123+
h->mark = 1;
124+
/* Keep all aliases of the symbol too. If an object symbol
125+
@@ -14491,17 +14495,12 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
126+
if (r_symndx == STN_UNDEF)
127+
return true;
128+
129+
- if (r_symndx >= rcookie->locsymcount
130+
- || ELF_ST_BIND (rcookie->locsyms[r_symndx].st_info) != STB_LOCAL)
131+
- {
132+
- struct elf_link_hash_entry *h;
133+
-
134+
- h = rcookie->sym_hashes[r_symndx - rcookie->extsymoff];
135+
-
136+
- while (h->root.type == bfd_link_hash_indirect
137+
- || h->root.type == bfd_link_hash_warning)
138+
- h = (struct elf_link_hash_entry *) h->root.u.i.link;
139+
+ struct elf_link_hash_entry *h;
140+
141+
+ h = get_ext_sym_hash (rcookie, r_symndx);
142+
+
143+
+ if (h != NULL)
144+
+ {
145+
if ((h->root.type == bfd_link_hash_defined
146+
|| h->root.type == bfd_link_hash_defweak)
147+
&& (h->root.u.def.section->owner != rcookie->abfd
148+
@@ -14525,6 +14524,7 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
149+
|| discarded_section (isec)))
150+
return true;
151+
}
152+
+
153+
return false;
154+
}
155+
return false;
156+
--
157+
2.33.8

‎SPECS/binutils/CVE-2025-1178.patch

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
From 75086e9de1707281172cc77f178e7949a4414ed0 Mon Sep 17 00:00:00 2001
2+
From: Nick Clifton <[email protected]>
3+
Date: Wed, 5 Feb 2025 13:26:51 +0000
4+
Subject: [PATCH] Prevent an abort in the bfd linker when attempting to
5+
generate dynamic relocs for a corrupt input file.
6+
7+
PR 32638
8+
---
9+
bfd/elf64-x86-64.c | 9 +++++++++
10+
1 file changed, 9 insertions(+)
11+
12+
diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c
13+
index 61334c3ab04..32db254ba6c 100644
14+
--- a/bfd/elf64-x86-64.c
15+
+++ b/bfd/elf64-x86-64.c
16+
@@ -5303,6 +5303,15 @@ elf_x86_64_finish_dynamic_symbol (bfd *output_bfd,
17+
18+
if (generate_dynamic_reloc)
19+
{
20+
+ /* If the relgot section has not been created, then
21+
+ generate an error instead of a reloc. cf PR 32638. */
22+
+ if (relgot == NULL || relgot->size == 0)
23+
+ {
24+
+ info->callbacks->einfo (_("%F%pB: Unable to generate dynamic relocs because a suitable section does not exist\n"),
25+
+ output_bfd);
26+
+ return false;
27+
+ }
28+
+
29+
if (relative_reloc_name != NULL
30+
&& htab->params->report_relative_reloc)
31+
_bfd_x86_elf_link_report_relative_reloc
32+
--
33+
2.43.5

0 commit comments

Comments
 (0)