Skip to content

Commit aac65c4

Browse files
sindhu-karrisameluchjslobodzian
committed
Co-authored-by: Sam Meluch <[email protected]> Co-authored-by: jslobodzian <[email protected]>
1 parent cbc750f commit aac65c4

File tree

9 files changed

+685
-13
lines changed

9 files changed

+685
-13
lines changed

‎SPECS/binutils/CVE-2025-1176.patch

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
From f9978defb6fab0bd8583942d97c112b0932ac814 Mon Sep 17 00:00:00 2001
2+
From: Nick Clifton <[email protected]>
3+
Date: Wed, 5 Feb 2025 11:15:11 +0000
4+
Subject: [PATCH] Prevent illegal memory access when indexing into the
5+
sym_hashes array of the elf bfd cookie structure.
6+
7+
PR 32636
8+
9+
Source: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f9978defb6fab0bd8583942d97c112b0932ac814
10+
---
11+
bfd/elflink.c | 90 +++++++++++++++++++++++++--------------------------
12+
1 file changed, 45 insertions(+), 45 deletions(-)
13+
14+
diff --git a/bfd/elflink.c b/bfd/elflink.c
15+
index 9a052082..9acfe8b8 100644
16+
--- a/bfd/elflink.c
17+
+++ b/bfd/elflink.c
18+
@@ -62,22 +62,37 @@ struct elf_find_verdep_info
19+
static bool _bfd_elf_fix_symbol_flags
20+
(struct elf_link_hash_entry *, struct elf_info_failed *);
21+
22+
-asection *
23+
-_bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
24+
- unsigned long r_symndx,
25+
- bool discard)
26+
+static struct elf_link_hash_entry *
27+
+get_ext_sym_hash (struct elf_reloc_cookie *cookie, unsigned long r_symndx)
28+
{
29+
- if (r_symndx >= cookie->locsymcount
30+
- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
31+
- {
32+
- struct elf_link_hash_entry *h;
33+
+ struct elf_link_hash_entry *h = NULL;
34+
35+
+ if ((r_symndx >= cookie->locsymcount
36+
+ || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
37+
+ /* Guard against corrupt input. See PR 32636 for an example. */
38+
+ && r_symndx >= cookie->extsymoff)
39+
+ {
40+
h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
41+
42+
while (h->root.type == bfd_link_hash_indirect
43+
|| h->root.type == bfd_link_hash_warning)
44+
h = (struct elf_link_hash_entry *) h->root.u.i.link;
45+
+ }
46+
+
47+
+ return h;
48+
+}
49+
50+
+asection *
51+
+_bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
52+
+ unsigned long r_symndx,
53+
+ bool discard)
54+
+{
55+
+ struct elf_link_hash_entry *h;
56+
+
57+
+ h = get_ext_sym_hash (cookie, r_symndx);
58+
+
59+
+ if (h != NULL)
60+
+ {
61+
if ((h->root.type == bfd_link_hash_defined
62+
|| h->root.type == bfd_link_hash_defweak)
63+
&& discarded_section (h->root.u.def.section))
64+
@@ -85,21 +100,20 @@ _bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
65+
else
66+
return NULL;
67+
}
68+
- else
69+
- {
70+
- /* It's not a relocation against a global symbol,
71+
- but it could be a relocation against a local
72+
- symbol for a discarded section. */
73+
- asection *isec;
74+
- Elf_Internal_Sym *isym;
75+
76+
- /* Need to: get the symbol; get the section. */
77+
- isym = &cookie->locsyms[r_symndx];
78+
- isec = bfd_section_from_elf_index (cookie->abfd, isym->st_shndx);
79+
- if (isec != NULL
80+
- && discard ? discarded_section (isec) : 1)
81+
- return isec;
82+
- }
83+
+ /* It's not a relocation against a global symbol,
84+
+ but it could be a relocation against a local
85+
+ symbol for a discarded section. */
86+
+ asection *isec;
87+
+ Elf_Internal_Sym *isym;
88+
+
89+
+ /* Need to: get the symbol; get the section. */
90+
+ isym = &cookie->locsyms[r_symndx];
91+
+ isec = bfd_section_from_elf_index (cookie->abfd, isym->st_shndx);
92+
+ if (isec != NULL
93+
+ && discard ? discarded_section (isec) : 1)
94+
+ return isec;
95+
+
96+
return NULL;
97+
}
98+
99+
@@ -13442,22 +13456,12 @@ _bfd_elf_gc_mark_rsec (struct bfd_link_info *info, asection *sec,
100+
if (r_symndx == STN_UNDEF)
101+
return NULL;
102+
103+
- if (r_symndx >= cookie->locsymcount
104+
- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
105+
+ h = get_ext_sym_hash (cookie, r_symndx);
106+
+
107+
+ if (h != NULL)
108+
{
109+
bool was_marked;
110+
111+
- h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
112+
- if (h == NULL)
113+
- {
114+
- info->callbacks->einfo (_("%F%P: corrupt input: %pB\n"),
115+
- sec->owner);
116+
- return NULL;
117+
- }
118+
- while (h->root.type == bfd_link_hash_indirect
119+
- || h->root.type == bfd_link_hash_warning)
120+
- h = (struct elf_link_hash_entry *) h->root.u.i.link;
121+
-
122+
was_marked = h->mark;
123+
h->mark = 1;
124+
/* Keep all aliases of the symbol too. If an object symbol
125+
@@ -14491,17 +14495,12 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
126+
if (r_symndx == STN_UNDEF)
127+
return true;
128+
129+
- if (r_symndx >= rcookie->locsymcount
130+
- || ELF_ST_BIND (rcookie->locsyms[r_symndx].st_info) != STB_LOCAL)
131+
- {
132+
- struct elf_link_hash_entry *h;
133+
-
134+
- h = rcookie->sym_hashes[r_symndx - rcookie->extsymoff];
135+
-
136+
- while (h->root.type == bfd_link_hash_indirect
137+
- || h->root.type == bfd_link_hash_warning)
138+
- h = (struct elf_link_hash_entry *) h->root.u.i.link;
139+
+ struct elf_link_hash_entry *h;
140+
141+
+ h = get_ext_sym_hash (rcookie, r_symndx);
142+
+
143+
+ if (h != NULL)
144+
+ {
145+
if ((h->root.type == bfd_link_hash_defined
146+
|| h->root.type == bfd_link_hash_defweak)
147+
&& (h->root.u.def.section->owner != rcookie->abfd
148+
@@ -14525,6 +14524,7 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
149+
|| discarded_section (isec)))
150+
return true;
151+
}
152+
+
153+
return false;
154+
}
155+
return false;
156+
--
157+
2.33.8

‎SPECS/binutils/CVE-2025-1178.patch

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
From 75086e9de1707281172cc77f178e7949a4414ed0 Mon Sep 17 00:00:00 2001
2+
From: Nick Clifton <[email protected]>
3+
Date: Wed, 5 Feb 2025 13:26:51 +0000
4+
Subject: [PATCH] Prevent an abort in the bfd linker when attempting to
5+
generate dynamic relocs for a corrupt input file.
6+
7+
PR 32638
8+
---
9+
bfd/elf64-x86-64.c | 9 +++++++++
10+
1 file changed, 9 insertions(+)
11+
12+
diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c
13+
index 61334c3ab04..32db254ba6c 100644
14+
--- a/bfd/elf64-x86-64.c
15+
+++ b/bfd/elf64-x86-64.c
16+
@@ -5303,6 +5303,15 @@ elf_x86_64_finish_dynamic_symbol (bfd *output_bfd,
17+
18+
if (generate_dynamic_reloc)
19+
{
20+
+ /* If the relgot section has not been created, then
21+
+ generate an error instead of a reloc. cf PR 32638. */
22+
+ if (relgot == NULL || relgot->size == 0)
23+
+ {
24+
+ info->callbacks->einfo (_("%F%pB: Unable to generate dynamic relocs because a suitable section does not exist\n"),
25+
+ output_bfd);
26+
+ return false;
27+
+ }
28+
+
29+
if (relative_reloc_name != NULL
30+
&& htab->params->report_relative_reloc)
31+
_bfd_x86_elf_link_report_relative_reloc
32+
--
33+
2.43.5

0 commit comments

Comments
 (0)