summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-devtools/binutils/binutils-2.34.inc1
-rw-r--r--meta/recipes-devtools/binutils/binutils/CVE-2023-25588.patch146
2 files changed, 147 insertions, 0 deletions
diff --git a/meta/recipes-devtools/binutils/binutils-2.34.inc b/meta/recipes-devtools/binutils/binutils-2.34.inc
index 713e428a3e..a9a2bf332f 100644
--- a/meta/recipes-devtools/binutils/binutils-2.34.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.34.inc
@@ -53,5 +53,6 @@ SRC_URI = "\
53 file://CVE-2020-16593.patch \ 53 file://CVE-2020-16593.patch \
54 file://0001-CVE-2021-45078.patch \ 54 file://0001-CVE-2021-45078.patch \
55 file://CVE-2022-38533.patch \ 55 file://CVE-2022-38533.patch \
56 file://CVE-2023-25588.patch \
56" 57"
57S = "${WORKDIR}/git" 58S = "${WORKDIR}/git"
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2023-25588.patch b/meta/recipes-devtools/binutils/binutils/CVE-2023-25588.patch
new file mode 100644
index 0000000000..065d8e47f0
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2023-25588.patch
@@ -0,0 +1,146 @@
1From d12f8998d2d086f0a6606589e5aedb7147e6f2f1 Mon Sep 17 00:00:00 2001
2From: Alan Modra <amodra@gmail.com>
3Date: Fri, 14 Oct 2022 10:30:21 +1030
4Subject: [PATCH] PR29677, Field `the_bfd` of `asymbol` is uninitialised
5
6Besides not initialising the_bfd of synthetic symbols, counting
7symbols when sizing didn't match symbols created if there were any
8dynsyms named "". We don't want synthetic symbols without names
9anyway, so get rid of them. Also, simplify and correct sanity checks.
10
11 PR 29677
12 * mach-o.c (bfd_mach_o_get_synthetic_symtab): Rewrite.
13---
14Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=d12f8998d2d086f0a6606589e5aedb7147e6f2f1]
15CVE: CVE-2023-25588
16Signed-off-by: Ashish Sharma <asharma@mvista.com>
17
18 bfd/mach-o.c | 72 ++++++++++++++++++++++------------------------------
19 1 file changed, 31 insertions(+), 41 deletions(-)
20
21diff --git a/bfd/mach-o.c b/bfd/mach-o.c
22index acb35e7f0c6..5279343768c 100644
23--- a/bfd/mach-o.c
24+++ b/bfd/mach-o.c
25@@ -938,11 +938,9 @@ bfd_mach_o_get_synthetic_symtab (bfd *abfd,
26 bfd_mach_o_symtab_command *symtab = mdata->symtab;
27 asymbol *s;
28 char * s_start;
29- char * s_end;
30 unsigned long count, i, j, n;
31 size_t size;
32 char *names;
33- char *nul_name;
34 const char stub [] = "$stub";
35
36 *ret = NULL;
37@@ -955,27 +953,27 @@ bfd_mach_o_get_synthetic_symtab (bfd *abfd,
38 /* We need to allocate a bfd symbol for every indirect symbol and to
39 allocate the memory for its name. */
40 count = dysymtab->nindirectsyms;
41- size = count * sizeof (asymbol) + 1;
42-
43+ size = 0;
44 for (j = 0; j < count; j++)
45 {
46- const char * strng;
47 unsigned int isym = dysymtab->indirect_syms[j];
48+ const char *str;
49
50 /* Some indirect symbols are anonymous. */
51- if (isym < symtab->nsyms && (strng = symtab->symbols[isym].symbol.name))
52- /* PR 17512: file: f5b8eeba. */
53- size += strnlen (strng, symtab->strsize - (strng - symtab->strtab)) + sizeof (stub);
54+ if (isym < symtab->nsyms
55+ && (str = symtab->symbols[isym].symbol.name) != NULL)
56+ {
57+ /* PR 17512: file: f5b8eeba. */
58+ size += strnlen (str, symtab->strsize - (str - symtab->strtab));
59+ size += sizeof (stub);
60+ }
61 }
62
63- s_start = bfd_malloc (size);
64+ s_start = bfd_malloc (size + count * sizeof (asymbol));
65 s = *ret = (asymbol *) s_start;
66 if (s == NULL)
67 return -1;
68 names = (char *) (s + count);
69- nul_name = names;
70- *names++ = 0;
71- s_end = s_start + size;
72
73 n = 0;
74 for (i = 0; i < mdata->nsects; i++)
75@@ -997,47 +995,39 @@ bfd_mach_o_get_synthetic_symtab (bfd *abfd,
76 entry_size = bfd_mach_o_section_get_entry_size (abfd, sec);
77
78 /* PR 17512: file: 08e15eec. */
79- if (first >= count || last >= count || first > last)
80+ if (first >= count || last > count || first > last)
81 goto fail;
82
83 for (j = first; j < last; j++)
84 {
85 unsigned int isym = dysymtab->indirect_syms[j];
86-
87- /* PR 17512: file: 04d64d9b. */
88- if (((char *) s) + sizeof (* s) > s_end)
89- goto fail;
90-
91- s->flags = BSF_GLOBAL | BSF_SYNTHETIC;
92- s->section = sec->bfdsection;
93- s->value = addr - sec->addr;
94- s->udata.p = NULL;
95+ const char *str;
96+ size_t len;
97
98 if (isym < symtab->nsyms
99- && symtab->symbols[isym].symbol.name)
100+ && (str = symtab->symbols[isym].symbol.name) != NULL)
101 {
102- const char *sym = symtab->symbols[isym].symbol.name;
103- size_t len;
104-
105- s->name = names;
106- len = strlen (sym);
107- /* PR 17512: file: 47dfd4d2. */
108- if (names + len >= s_end)
109+ /* PR 17512: file: 04d64d9b. */
110+ if (n >= count)
111 goto fail;
112- memcpy (names, sym, len);
113- names += len;
114- /* PR 17512: file: 18f340a4. */
115- if (names + sizeof (stub) >= s_end)
116+ len = strnlen (str, symtab->strsize - (str - symtab->strtab));
117+ /* PR 17512: file: 47dfd4d2, 18f340a4. */
118+ if (size < len + sizeof (stub))
119 goto fail;
120- memcpy (names, stub, sizeof (stub));
121- names += sizeof (stub);
122+ memcpy (names, str, len);
123+ memcpy (names + len, stub, sizeof (stub));
124+ s->name = names;
125+ names += len + sizeof (stub);
126+ size -= len + sizeof (stub);
127+ s->the_bfd = symtab->symbols[isym].symbol.the_bfd;
128+ s->flags = BSF_GLOBAL | BSF_SYNTHETIC;
129+ s->section = sec->bfdsection;
130+ s->value = addr - sec->addr;
131+ s->udata.p = NULL;
132+ s++;
133+ n++;
134 }
135- else
136- s->name = nul_name;
137-
138 addr += entry_size;
139- s++;
140- n++;
141 }
142 break;
143 default:
144--
1452.39.3
146
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-06-29 19:50:01 +0000