summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorThiruvadi Rajaraman <trajaraman@mvista.com>2017-09-20 13:22:09 +0530
committerRichard Purdie <richard.purdie@linuxfoundation.org>2018-01-07 17:10:08 +0000
commit226c2fd1f720da30abf906179c64061e9f121dfc (patch)
treed2233a3df2b98689fae0eeafa491db14d41ba6e1
parentfdee751f82a4299b0ac0bdc42708f6253e950505 (diff)
downloadpoky-226c2fd1f720da30abf906179c64061e9f121dfc.tar.gz
binutils: CVE-2017-8394
Source: git://sourceware.org/git/binutils-gdb.git MR: 74166 Type: Security Fix Disposition: Backport from binutils-2_29 ChangeID: d614742d33a55da6cafede60cd171766afb0aa1d Description: PR 21414, null pointer deref of _bfd_elf_large_com_section sym PR 21414 * section.c (GLOBAL_SYM_INIT): Make available in bfd.h. * elf.c (lcomm_sym): New. (_bfd_elf_large_com_section): Use lcomm_sym section symbol. * bfd-in2.h: Regenerate. Affects: <= 2.29 Author: Alan Modra <amodra@gmail.com> (From OE-Core rev: 0d6e08ffc4760947653ad9368d594074d506f697) Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com> Reviewed-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat
-rw-r--r--meta/recipes-devtools/binutils/binutils-2.27.inc2
-rw-r--r--meta/recipes-devtools/binutils/binutils/CVE-2017-8394.patch114
-rw-r--r--meta/recipes-devtools/binutils/binutils/CVE-2017-8394_1.patch80
3 files changed, 196 insertions, 0 deletions
diff --git a/meta/recipes-devtools/binutils/binutils-2.27.inc b/meta/recipes-devtools/binutils/binutils-2.27.inc
index 3e514fc042..a455b0192c 100644
--- a/meta/recipes-devtools/binutils/binutils-2.27.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.27.inc
@@ -73,6 +73,8 @@ SRC_URI = "\
73 file://CVE-2017-7300.patch \ 73 file://CVE-2017-7300.patch \
74 file://CVE-2017-8396.patch \ 74 file://CVE-2017-8396.patch \
75 file://CVE-2017-8421.patch \ 75 file://CVE-2017-8421.patch \
76 file://CVE-2017-8394_1.patch \
77 file://CVE-2017-8394.patch \
76" 78"
77S = "${WORKDIR}/git" 79S = "${WORKDIR}/git"
78 80
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2017-8394.patch b/meta/recipes-devtools/binutils/binutils/CVE-2017-8394.patch
new file mode 100644
index 0000000000..14ee1910f4
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2017-8394.patch
@@ -0,0 +1,114 @@
1commit 7eacd66b086cabb1daab20890d5481894d4f56b2
2Author: Alan Modra <amodra@gmail.com>
3Date: Sun Apr 23 15:21:11 2017 +0930
4
5 PR 21414, null pointer deref of _bfd_elf_large_com_section sym
6
7 PR 21414
8 * section.c (GLOBAL_SYM_INIT): Make available in bfd.h.
9 * elf.c (lcomm_sym): New.
10 (_bfd_elf_large_com_section): Use lcomm_sym section symbol.
11 * bfd-in2.h: Regenerate.
12
13Upstream-Status: Backport
14
15CVE: CVE-2017-8394
16Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
17
18Index: git/bfd/bfd-in2.h
19===================================================================
20--- git.orig/bfd/bfd-in2.h 2017-09-20 12:54:44.847475928 +0530
21+++ git/bfd/bfd-in2.h 2017-09-20 12:54:44.903476171 +0530
22@@ -1805,6 +1805,18 @@
23 { NULL }, { NULL } \
24 }
25
26+/* We use a macro to initialize the static asymbol structures because
27+ traditional C does not permit us to initialize a union member while
28+ gcc warns if we don't initialize it.
29+ the_bfd, name, value, attr, section [, udata] */
30+#ifdef __STDC__
31+#define GLOBAL_SYM_INIT(NAME, SECTION) \
32+ { 0, NAME, 0, BSF_SECTION_SYM, SECTION, { 0 }}
33+#else
34+#define GLOBAL_SYM_INIT(NAME, SECTION) \
35+ { 0, NAME, 0, BSF_SECTION_SYM, SECTION }
36+#endif
37+
38 void bfd_section_list_clear (bfd *);
39
40 asection *bfd_get_section_by_name (bfd *abfd, const char *name);
41Index: git/bfd/section.c
42===================================================================
43--- git.orig/bfd/section.c 2017-09-20 12:54:44.847475928 +0530
44+++ git/bfd/section.c 2017-09-20 12:54:44.903476171 +0530
45@@ -738,20 +738,20 @@
46 . { NULL }, { NULL } \
47 . }
48 .
49+.{* We use a macro to initialize the static asymbol structures because
50+. traditional C does not permit us to initialize a union member while
51+. gcc warns if we don't initialize it.
52+. the_bfd, name, value, attr, section [, udata] *}
53+.#ifdef __STDC__
54+.#define GLOBAL_SYM_INIT(NAME, SECTION) \
55+. { 0, NAME, 0, BSF_SECTION_SYM, SECTION, { 0 }}
56+.#else
57+.#define GLOBAL_SYM_INIT(NAME, SECTION) \
58+. { 0, NAME, 0, BSF_SECTION_SYM, SECTION }
59+.#endif
60+.
61 */
62
63-/* We use a macro to initialize the static asymbol structures because
64- traditional C does not permit us to initialize a union member while
65- gcc warns if we don't initialize it. */
66- /* the_bfd, name, value, attr, section [, udata] */
67-#ifdef __STDC__
68-#define GLOBAL_SYM_INIT(NAME, SECTION) \
69- { 0, NAME, 0, BSF_SECTION_SYM, SECTION, { 0 }}
70-#else
71-#define GLOBAL_SYM_INIT(NAME, SECTION) \
72- { 0, NAME, 0, BSF_SECTION_SYM, SECTION }
73-#endif
74-
75 /* These symbols are global, not specific to any BFD. Therefore, anything
76 that tries to change them is broken, and should be repaired. */
77
78Index: git/bfd/ChangeLog
79===================================================================
80--- git.orig/bfd/ChangeLog 2017-09-20 12:54:44.735475444 +0530
81+++ git/bfd/ChangeLog 2017-09-20 12:54:44.903476171 +0530
82@@ -102,6 +102,14 @@
83 * readelf.c (process_mips_specific): Remove null GOT data check.
84
85 2017-04-23 Alan Modra <amodra@gmail.com>
86+
87+ PR 21414
88+ * section.c (GLOBAL_SYM_INIT): Make available in bfd.h.
89+ * elf.c (lcomm_sym): New.
90+ (_bfd_elf_large_com_section): Use lcomm_sym section symbol.
91+ * bfd-in2.h: Regenerate.
92+
93+2017-04-23 Alan Modra <amodra@gmail.com>
94
95 PR 21412
96 * elf-bfd.h (struct elf_backend_data <get_reloc_section>): Change
97Index: git/bfd/elf.c
98===================================================================
99--- git.orig/bfd/elf.c 2017-09-20 12:54:44.847475928 +0530
100+++ git/bfd/elf.c 2017-09-20 13:00:22.636091768 +0530
101@@ -10986,9 +10986,11 @@
102
103 /* It is only used by x86-64 so far.
104 ??? This repeats *COM* id of zero. sec->id is supposed to be unique,
105- but current usage would allow all of _bfd_std_section to be zero. t*/
106+ but current usage would allow all of _bfd_std_section to be zero. */
107+static const asymbol lcomm_sym
108+ = GLOBAL_SYM_INIT ("LARGE_COMMON", &_bfd_elf_large_com_section);
109 asection _bfd_elf_large_com_section
110- = BFD_FAKE_SECTION (_bfd_elf_large_com_section, NULL,
111+ = BFD_FAKE_SECTION (_bfd_elf_large_com_section, &lcomm_sym,
112 "LARGE_COMMON", 0, SEC_IS_COMMON);
113
114 void
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2017-8394_1.patch b/meta/recipes-devtools/binutils/binutils/CVE-2017-8394_1.patch
new file mode 100644
index 0000000000..e1dfd8bb40
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2017-8394_1.patch
@@ -0,0 +1,80 @@
1commit 821e6ff6299aa39e841ca50e1ae8a98e3554fd5f
2Author: Alan Modra <amodra@gmail.com>
3Date: Wed Oct 12 09:41:33 2016 +1030
4
5 BFD_FAKE_SECTION macro params
6
7 Order NAME, IDX, FLAGS as per STD_SECTION macro.
8
9 * section.c (BFD_FAKE_SECTION): Reorder parameters. Formatting.
10 (STD_SECTION): Adjust to suit.
11 * elf.c (_bfd_elf_large_com_section): Likewise.
12 * bfd-in2.h: Regenerate.
13
14Upstream-Status: Backport
15
16CVE: CVE-2017-8394
17Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
18
19
20Index: git/bfd/bfd-in2.h
21===================================================================
22--- git.orig/bfd/bfd-in2.h 2017-09-20 12:54:42.423465338 +0530
23+++ git/bfd/bfd-in2.h 2017-09-20 13:02:48.000000000 +0530
24@@ -1767,9 +1767,9 @@
25 #define bfd_section_removed_from_list(ABFD, S) \
26 ((S)->next == NULL ? (ABFD)->section_last != (S) : (S)->next->prev != (S))
27
28-#define BFD_FAKE_SECTION(SEC, FLAGS, SYM, NAME, IDX) \
29+#define BFD_FAKE_SECTION(SEC, SYM, NAME, IDX, FLAGS) \
30 /* name, id, index, next, prev, flags, user_set_vma, */ \
31- { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \
32+ { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \
33 \
34 /* linker_mark, linker_has_input, gc_mark, decompress_status, */ \
35 0, 0, 1, 0, \
36Index: git/bfd/elf.c
37===================================================================
38--- git.orig/bfd/elf.c 2017-09-20 12:54:44.503474440 +0530
39+++ git/bfd/elf.c 2017-09-20 13:02:48.000000000 +0530
40@@ -10984,10 +10984,12 @@
41 return n;
42 }
43
44-/* It is only used by x86-64 so far. */
45+/* It is only used by x86-64 so far.
46+ ??? This repeats *COM* id of zero. sec->id is supposed to be unique,
47+ but current usage would allow all of _bfd_std_section to be zero. t*/
48 asection _bfd_elf_large_com_section
49- = BFD_FAKE_SECTION (_bfd_elf_large_com_section,
50- SEC_IS_COMMON, NULL, "LARGE_COMMON", 0);
51+ = BFD_FAKE_SECTION (_bfd_elf_large_com_section, NULL,
52+ "LARGE_COMMON", 0, SEC_IS_COMMON);
53
54 void
55 _bfd_elf_post_process_headers (bfd * abfd,
56Index: git/bfd/section.c
57===================================================================
58--- git.orig/bfd/section.c 2017-09-20 12:54:43.815471454 +0530
59+++ git/bfd/section.c 2017-09-20 13:02:48.000000000 +0530
60@@ -700,9 +700,9 @@
61 .#define bfd_section_removed_from_list(ABFD, S) \
62 . ((S)->next == NULL ? (ABFD)->section_last != (S) : (S)->next->prev != (S))
63 .
64-.#define BFD_FAKE_SECTION(SEC, FLAGS, SYM, NAME, IDX) \
65+.#define BFD_FAKE_SECTION(SEC, SYM, NAME, IDX, FLAGS) \
66 . {* name, id, index, next, prev, flags, user_set_vma, *} \
67-. { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \
68+. { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \
69 . \
70 . {* linker_mark, linker_has_input, gc_mark, decompress_status, *} \
71 . 0, 0, 1, 0, \
72@@ -764,7 +764,7 @@
73 };
74
75 #define STD_SECTION(NAME, IDX, FLAGS) \
76- BFD_FAKE_SECTION(_bfd_std_section[IDX], FLAGS, &global_syms[IDX], NAME, IDX)
77+ BFD_FAKE_SECTION(_bfd_std_section[IDX], &global_syms[IDX], NAME, IDX, FLAGS)
78
79 asection _bfd_std_section[] = {
80 STD_SECTION (BFD_COM_SECTION_NAME, 0, SEC_IS_COMMON),
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-03 22:00:20 +0000