summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-devtools/binutils/binutils-2.38.inc3
-rw-r--r--meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-1.patch31
-rw-r--r--meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-2.patch115
-rw-r--r--meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-3.patch122
4 files changed, 271 insertions, 0 deletions
diff --git a/meta/recipes-devtools/binutils/binutils-2.38.inc b/meta/recipes-devtools/binutils/binutils-2.38.inc
index 5c3ff3d93a..3bcb0cabb8 100644
--- a/meta/recipes-devtools/binutils/binutils-2.38.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.38.inc
@@ -56,5 +56,8 @@ SRC_URI = "\
56 file://0023-CVE-2023-25585.patch \ 56 file://0023-CVE-2023-25585.patch \
57 file://0026-CVE-2023-1972.patch \ 57 file://0026-CVE-2023-1972.patch \
58 file://0025-CVE-2023-25588.patch \ 58 file://0025-CVE-2023-25588.patch \
59 file://0029-CVE-2022-48065-1.patch \
60 file://0029-CVE-2022-48065-2.patch \
61 file://0029-CVE-2022-48065-3.patch \
59" 62"
60S = "${WORKDIR}/git" 63S = "${WORKDIR}/git"
diff --git a/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-1.patch b/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-1.patch
new file mode 100644
index 0000000000..4642251f9b
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-1.patch
@@ -0,0 +1,31 @@
1From: Jan Beulich <jbeulich@suse.com>
2Date: Tue, 29 Mar 2022 06:19:14 +0000 (+0200)
3Subject: bfd/Dwarf2: gas doesn't mangle names
4X-Git-Tag: binutils-2_39~1287
5X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=ddfc2f56d5782af79c696d7fef7c73bba11e8b09
6
7bfd/Dwarf2: gas doesn't mangle names
8
9Include the language identifier emitted by gas in the set of ones where
10no mangled names are expected. Even if there could be "hand-mangled"
11names, gas doesn't emit DW_AT_linkage_name in the first place.
12Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=ddfc2f56d5782af79c696d7fef7c73bba11e8b09]
13
14CVE: CVE-2022-48065
15
16Signed-off-by: Sanjana Venkatesh <Sanjana.Venkatesh@windriver.com>
17
18---
19
20diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c
21index 8cd0ce9d425..9aa4e955a5e 100644
22--- a/bfd/dwarf2.c
23+++ b/bfd/dwarf2.c
24@@ -1441,6 +1441,7 @@ non_mangled (int lang)
25 case DW_LANG_PLI:
26 case DW_LANG_UPC:
27 case DW_LANG_C11:
28+ case DW_LANG_Mips_Assembler:
29 return true;
30 }
31 }
diff --git a/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-2.patch b/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-2.patch
new file mode 100644
index 0000000000..8aa21f2716
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-2.patch
@@ -0,0 +1,115 @@
1From: Alan Modra <amodra@gmail.com>
2Date: Wed, 21 Sep 2022 05:15:44 +0000 (+0930)
3Subject: dwarf2.c: mangle_style
4X-Git-Tag: gdb-13-branchpoint~1165
5X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=4609af80c29db6015ce01b67c48f237c210da9b4
6
7dwarf2.c: mangle_style
8
9non_mangled incorrectly returned "true" for Ada. Correct that, and
10add a few more non-mangled entries. Return a value suitable for
11passing to cplus_demangle to control demangling.
12
13 * dwarf2.c: Include demangle.h.
14 (mangle_style): Rename from non_mangled. Return DMGL_* value
15 to suit lang. Adjust all callers.
16Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=4609af80c29db6015ce01b67c48f237c210da9b4]
17
18CVE: CVE-2022-48065
19
20Signed-off-by: Sanjana Venkatesh <Sanjana.Venkatesh@windriver.com>
21
22---
23
24diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c
25index e7c12c3e9de..138cdbb00bb 100644
26--- a/bfd/dwarf2.c
27+++ b/bfd/dwarf2.c
28@@ -32,6 +32,7 @@
29 #include "sysdep.h"
30 #include "bfd.h"
31 #include "libiberty.h"
32+#include "demangle.h"
33 #include "libbfd.h"
34 #include "elf-bfd.h"
35 #include "dwarf2.h"
36@@ -1711,31 +1712,52 @@ read_attribute (struct attribute * attr,
37 return info_ptr;
38 }
39
40-/* Return whether DW_AT_name will return the same as DW_AT_linkage_name
41- for a function. */
42+/* Return mangling style given LANG. */
43
44-static bool
45-non_mangled (int lang)
46+static int
47+mangle_style (int lang)
48 {
49 switch (lang)
50 {
51+ case DW_LANG_Ada83:
52+ case DW_LANG_Ada95:
53+ return DMGL_GNAT;
54+
55+ case DW_LANG_C_plus_plus:
56+ case DW_LANG_C_plus_plus_03:
57+ case DW_LANG_C_plus_plus_11:
58+ case DW_LANG_C_plus_plus_14:
59+ return DMGL_GNU_V3;
60+
61+ case DW_LANG_Java:
62+ return DMGL_JAVA;
63+
64+ case DW_LANG_D:
65+ return DMGL_DLANG;
66+
67+ case DW_LANG_Rust:
68+ case DW_LANG_Rust_old:
69+ return DMGL_RUST;
70+
71 default:
72- return false;
73+ return DMGL_AUTO;
74
75 case DW_LANG_C89:
76 case DW_LANG_C:
77- case DW_LANG_Ada83:
78 case DW_LANG_Cobol74:
79 case DW_LANG_Cobol85:
80 case DW_LANG_Fortran77:
81 case DW_LANG_Pascal83:
82- case DW_LANG_C99:
83- case DW_LANG_Ada95:
84 case DW_LANG_PLI:
85+ case DW_LANG_C99:
86 case DW_LANG_UPC:
87 case DW_LANG_C11:
88 case DW_LANG_Mips_Assembler:
89- return true;
90+ case DW_LANG_Upc:
91+ case DW_LANG_HP_Basic91:
92+ case DW_LANG_HP_IMacro:
93+ case DW_LANG_HP_Assembler:
94+ return 0;
95 }
96 }
97
98@@ -3599,7 +3621,7 @@ find_abstract_instance (struct comp_unit *unit,
99 if (name == NULL && is_str_form (&attr))
100 {
101 name = attr.u.str;
102- if (non_mangled (unit->lang))
103+ if (mangle_style (unit->lang) == 0)
104 *is_linkage = true;
105 }
106 break;
107@@ -4095,7 +4117,7 @@ scan_unit_for_symbols (struct comp_unit *unit)
108 if (func->name == NULL && is_str_form (&attr))
109 {
110 func->name = attr.u.str;
111- if (non_mangled (unit->lang))
112+ if (mangle_style (unit->lang) == 0)
113 func->is_linkage = true;
114 }
115 break;
diff --git a/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-3.patch b/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-3.patch
new file mode 100644
index 0000000000..35a658a22c
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/0029-CVE-2022-48065-3.patch
@@ -0,0 +1,122 @@
1From: Alan Modra <amodra@gmail.com>
2Date: Wed, 21 Dec 2022 11:10:12 +0000 (+1030)
3Subject: PR29925, Memory leak in find_abstract_instance
4X-Git-Tag: binutils-2_40~192
5X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=d28fbc7197ba0e021a43f873eff90b05dcdcff6a
6
7PR29925, Memory leak in find_abstract_instance
8
9The testcase in the PR had a variable with both DW_AT_decl_file and
10DW_AT_specification, where the DW_AT_specification also specified
11DW_AT_decl_file. This leads to a memory leak as the file name is
12malloced and duplicates are not expected.
13
14I've also changed find_abstract_instance to not use a temp for "name",
15because that can result in a change in behaviour from the usual last
16of duplicate attributes wins.
17
18 PR 29925
19 * dwarf2.c (find_abstract_instance): Delete "name" variable.
20 Free *filename_ptr before assigning new file name.
21 (scan_unit_for_symbols): Similarly free func->file and
22 var->file before assigning.
23Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=d28fbc7197ba0e021a43f873eff90b05dcdcff6a]
24
25CVE: CVE-2022-48065
26
27Signed-off-by: Sanjana Venkatesh <Sanjana.Venkatesh@windriver.com>
28
29---
30
31diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c
32index 0cd8152ee6e..b608afbc0cf 100644
33--- a/bfd/dwarf2.c
34+++ b/bfd/dwarf2.c
35@@ -3441,7 +3441,6 @@ find_abstract_instance (struct comp_unit *unit,
36 struct abbrev_info *abbrev;
37 uint64_t die_ref = attr_ptr->u.val;
38 struct attribute attr;
39- const char *name = NULL;
40
41 if (recur_count == 100)
42 {
43@@ -3602,9 +3601,9 @@ find_abstract_instance (struct comp_unit *unit,
44 case DW_AT_name:
45 /* Prefer DW_AT_MIPS_linkage_name or DW_AT_linkage_name
46 over DW_AT_name. */
47- if (name == NULL && is_str_form (&attr))
48+ if (*pname == NULL && is_str_form (&attr))
49 {
50- name = attr.u.str;
51+ *pname = attr.u.str;
52 if (mangle_style (unit->lang) == 0)
53 *is_linkage = true;
54 }
55@@ -3612,7 +3611,7 @@ find_abstract_instance (struct comp_unit *unit,
56 case DW_AT_specification:
57 if (is_int_form (&attr)
58 && !find_abstract_instance (unit, &attr, recur_count + 1,
59- &name, is_linkage,
60+ pname, is_linkage,
61 filename_ptr, linenumber_ptr))
62 return false;
63 break;
64@@ -3622,7 +3621,7 @@ find_abstract_instance (struct comp_unit *unit,
65 non-string forms into these attributes. */
66 if (is_str_form (&attr))
67 {
68- name = attr.u.str;
69+ *pname = attr.u.str;
70 *is_linkage = true;
71 }
72 break;
73@@ -3630,8 +3629,11 @@ find_abstract_instance (struct comp_unit *unit,
74 if (!comp_unit_maybe_decode_line_info (unit))
75 return false;
76 if (is_int_form (&attr))
77- *filename_ptr = concat_filename (unit->line_table,
78- attr.u.val);
79+ {
80+ free (*filename_ptr);
81+ *filename_ptr = concat_filename (unit->line_table,
82+ attr.u.val);
83+ }
84 break;
85 case DW_AT_decl_line:
86 if (is_int_form (&attr))
87@@ -3643,7 +3645,6 @@ find_abstract_instance (struct comp_unit *unit,
88 }
89 }
90 }
91- *pname = name;
92 return true;
93 }
94
95@@ -4139,8 +4140,11 @@ scan_unit_for_symbols (struct comp_unit *unit)
96
97 case DW_AT_decl_file:
98 if (is_int_form (&attr))
99- func->file = concat_filename (unit->line_table,
100- attr.u.val);
101+ {
102+ free (func->file);
103+ func->file = concat_filename (unit->line_table,
104+ attr.u.val);
105+ }
106 break;
107
108 case DW_AT_decl_line:
109@@ -4182,8 +4186,11 @@ scan_unit_for_symbols (struct comp_unit *unit)
110
111 case DW_AT_decl_file:
112 if (is_int_form (&attr))
113- var->file = concat_filename (unit->line_table,
114- attr.u.val);
115+ {
116+ free (var->file);
117+ var->file = concat_filename (unit->line_table,
118+ attr.u.val);
119+ }
120 break;
121
122 case DW_AT_decl_line:
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-01-08 23:21:25 +0000