binutils: patch CVE-2025-11083

Pick patch per link in NVD report.

(From OE-Core rev: 99879f41af7272e597c9a8c4c0260d1b690f9051)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>

2 files changed, 78 insertions, 0 deletions

diff --git a/meta/recipes-devtools/binutils/binutils-2.38.inc b/meta/recipes-devtools/binutils/binutils-2.38.inc
index 0fd950e694..2e978edc6f 100644
--- a/meta/recipes-devtools/binutils/binutils-2.38.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.38.inc
@@ -81,5 +81,6 @@ SRC_URI = "\
      file://0043-CVE-2025-7546.patch \
      file://0043-CVE-2025-7545.patch \
      file://0044-CVE-2025-11082.patch \
+     file://0045-CVE-2025-11083.patch \
 "
 S  = "${WORKDIR}/git"
diff --git a/meta/recipes-devtools/binutils/binutils/0045-CVE-2025-11083.patch b/meta/recipes-devtools/binutils/binutils/0045-CVE-2025-11083.patch
new file mode 100644
index 0000000000..d303f651b8
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/0045-CVE-2025-11083.patch
@@ -0,0 +1,77 @@
+From 9ca499644a21ceb3f946d1c179c38a83be084490 Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Thu, 18 Sep 2025 16:59:25 -0700
+Subject: [PATCH] elf: Don't match corrupt section header in linker input
+
+Don't swap in nor match corrupt section header in linker input to avoid
+linker crash later.
+
+        PR ld/33457
+        * elfcode.h (elf_swap_shdr_in): Changed to return bool.  Return
+        false for corrupt section header in linker input.
+        (elf_object_p): Reject if elf_swap_shdr_in returns false.
+
+Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+
+CVE: CVE-2025-11083
+Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=9ca499644a21ceb3f946d1c179c38a83be084490]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ bfd/elfcode.h | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/bfd/elfcode.h b/bfd/elfcode.h
+index 9c65852e103..5224a1abee6 100644
+--- a/bfd/elfcode.h
++++ b/bfd/elfcode.h
+@@ -298,7 +298,7 @@ elf_swap_ehdr_out (bfd *abfd,
+ /* Translate an ELF section header table entry in external format into an
+    ELF section header table entry in internal format.  */
+ 
+-static void
++static bool
+ elf_swap_shdr_in (bfd *abfd,
+                  const Elf_External_Shdr *src,
+                  Elf_Internal_Shdr *dst)
+@@ -328,6 +328,9 @@ elf_swap_shdr_in (bfd *abfd,
+          if (!abfd->read_only)
+            _bfd_error_handler (_("warning: %pB has a section "
+                                  "extending past end of file"), abfd);
++         /* PR ld/33457: Don't match corrupt section header.  */
++         if (abfd->is_linker_input)
++           return false;
+          abfd->read_only = 1;
+        }
+     }
+@@ -337,6 +340,7 @@ elf_swap_shdr_in (bfd *abfd,
+   dst->sh_entsize = H_GET_WORD (abfd, src->sh_entsize);
+   dst->bfd_section = NULL;
+   dst->contents = NULL;
++  return true;
+ }
+ 
+ /* Translate an ELF section header table entry in internal format into an
+@@ -629,9 +633,9 @@ elf_object_p (bfd *abfd)
+ 
+       /* Read the first section header at index 0, and convert to internal
+         form.  */
+-      if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr))
++      if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr)
++         || !elf_swap_shdr_in (abfd, &x_shdr, &i_shdr))
+        goto got_no_match;
+-      elf_swap_shdr_in (abfd, &x_shdr, &i_shdr);
+ 
+       /* If the section count is zero, the actual count is in the first
+         section header.  */
+@@ -717,9 +721,9 @@ elf_object_p (bfd *abfd)
+         to internal form.  */
+       for (shindex = 1; shindex < i_ehdrp->e_shnum; shindex++)
+        {
+-         if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr))
++         if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr)
++             || !elf_swap_shdr_in (abfd, &x_shdr, i_shdrp + shindex))
+            goto got_no_match;
+-         elf_swap_shdr_in (abfd, &x_shdr, i_shdrp + shindex);
+ 
+          /* Sanity check sh_link and sh_info.  */
+          if (i_shdrp[shindex].sh_link >= num_sec)