mirror of
https://git.yoctoproject.org/poky
synced 2026-02-26 11:29:40 +01:00
binutils: CVE-2017-8394
Source: git://sourceware.org/git/binutils-gdb.git
MR: 74166
Type: Security Fix
Disposition: Backport from binutils-2_29
ChangeID: d614742d33a55da6cafede60cd171766afb0aa1d
Description:
PR 21414, null pointer deref of _bfd_elf_large_com_section sym
PR 21414
* section.c (GLOBAL_SYM_INIT): Make available in bfd.h.
* elf.c (lcomm_sym): New.
(_bfd_elf_large_com_section): Use lcomm_sym section symbol.
* bfd-in2.h: Regenerate.
Affects: <= 2.29
Author: Alan Modra <amodra@gmail.com>
(From OE-Core rev: 0d6e08ffc4760947653ad9368d594074d506f697)
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
Reviewed-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Thiruvadi Rajaraman
committed by
Richard Purdie
Richard Purdie
parent
fdee751f82
commit
226c2fd1f7
@@ -73,6 +73,8 @@ SRC_URI = "\
|
||||
file://CVE-2017-7300.patch \
|
||||
file://CVE-2017-8396.patch \
|
||||
file://CVE-2017-8421.patch \
|
||||
file://CVE-2017-8394_1.patch \
|
||||
file://CVE-2017-8394.patch \
|
||||
"
|
||||
S = "${WORKDIR}/git"
|
||||
|
||||
|
||||
114
meta/recipes-devtools/binutils/binutils/CVE-2017-8394.patch
Normal file
114
meta/recipes-devtools/binutils/binutils/CVE-2017-8394.patch
Normal file
@@ -0,0 +1,114 @@
|
||||
commit 7eacd66b086cabb1daab20890d5481894d4f56b2
|
||||
Author: Alan Modra <amodra@gmail.com>
|
||||
Date: Sun Apr 23 15:21:11 2017 +0930
|
||||
|
||||
PR 21414, null pointer deref of _bfd_elf_large_com_section sym
|
||||
|
||||
PR 21414
|
||||
* section.c (GLOBAL_SYM_INIT): Make available in bfd.h.
|
||||
* elf.c (lcomm_sym): New.
|
||||
(_bfd_elf_large_com_section): Use lcomm_sym section symbol.
|
||||
* bfd-in2.h: Regenerate.
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
CVE: CVE-2017-8394
|
||||
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
|
||||
|
||||
Index: git/bfd/bfd-in2.h
|
||||
===================================================================
|
||||
--- git.orig/bfd/bfd-in2.h 2017-09-20 12:54:44.847475928 +0530
|
||||
+++ git/bfd/bfd-in2.h 2017-09-20 12:54:44.903476171 +0530
|
||||
@@ -1805,6 +1805,18 @@
|
||||
{ NULL }, { NULL } \
|
||||
}
|
||||
|
||||
+/* We use a macro to initialize the static asymbol structures because
|
||||
+ traditional C does not permit us to initialize a union member while
|
||||
+ gcc warns if we don't initialize it.
|
||||
+ the_bfd, name, value, attr, section [, udata] */
|
||||
+#ifdef __STDC__
|
||||
+#define GLOBAL_SYM_INIT(NAME, SECTION) \
|
||||
+ { 0, NAME, 0, BSF_SECTION_SYM, SECTION, { 0 }}
|
||||
+#else
|
||||
+#define GLOBAL_SYM_INIT(NAME, SECTION) \
|
||||
+ { 0, NAME, 0, BSF_SECTION_SYM, SECTION }
|
||||
+#endif
|
||||
+
|
||||
void bfd_section_list_clear (bfd *);
|
||||
|
||||
asection *bfd_get_section_by_name (bfd *abfd, const char *name);
|
||||
Index: git/bfd/section.c
|
||||
===================================================================
|
||||
--- git.orig/bfd/section.c 2017-09-20 12:54:44.847475928 +0530
|
||||
+++ git/bfd/section.c 2017-09-20 12:54:44.903476171 +0530
|
||||
@@ -738,20 +738,20 @@
|
||||
. { NULL }, { NULL } \
|
||||
. }
|
||||
.
|
||||
+.{* We use a macro to initialize the static asymbol structures because
|
||||
+. traditional C does not permit us to initialize a union member while
|
||||
+. gcc warns if we don't initialize it.
|
||||
+. the_bfd, name, value, attr, section [, udata] *}
|
||||
+.#ifdef __STDC__
|
||||
+.#define GLOBAL_SYM_INIT(NAME, SECTION) \
|
||||
+. { 0, NAME, 0, BSF_SECTION_SYM, SECTION, { 0 }}
|
||||
+.#else
|
||||
+.#define GLOBAL_SYM_INIT(NAME, SECTION) \
|
||||
+. { 0, NAME, 0, BSF_SECTION_SYM, SECTION }
|
||||
+.#endif
|
||||
+.
|
||||
*/
|
||||
|
||||
-/* We use a macro to initialize the static asymbol structures because
|
||||
- traditional C does not permit us to initialize a union member while
|
||||
- gcc warns if we don't initialize it. */
|
||||
- /* the_bfd, name, value, attr, section [, udata] */
|
||||
-#ifdef __STDC__
|
||||
-#define GLOBAL_SYM_INIT(NAME, SECTION) \
|
||||
- { 0, NAME, 0, BSF_SECTION_SYM, SECTION, { 0 }}
|
||||
-#else
|
||||
-#define GLOBAL_SYM_INIT(NAME, SECTION) \
|
||||
- { 0, NAME, 0, BSF_SECTION_SYM, SECTION }
|
||||
-#endif
|
||||
-
|
||||
/* These symbols are global, not specific to any BFD. Therefore, anything
|
||||
that tries to change them is broken, and should be repaired. */
|
||||
|
||||
Index: git/bfd/ChangeLog
|
||||
===================================================================
|
||||
--- git.orig/bfd/ChangeLog 2017-09-20 12:54:44.735475444 +0530
|
||||
+++ git/bfd/ChangeLog 2017-09-20 12:54:44.903476171 +0530
|
||||
@@ -102,6 +102,14 @@
|
||||
* readelf.c (process_mips_specific): Remove null GOT data check.
|
||||
|
||||
2017-04-23 Alan Modra <amodra@gmail.com>
|
||||
+
|
||||
+ PR 21414
|
||||
+ * section.c (GLOBAL_SYM_INIT): Make available in bfd.h.
|
||||
+ * elf.c (lcomm_sym): New.
|
||||
+ (_bfd_elf_large_com_section): Use lcomm_sym section symbol.
|
||||
+ * bfd-in2.h: Regenerate.
|
||||
+
|
||||
+2017-04-23 Alan Modra <amodra@gmail.com>
|
||||
|
||||
PR 21412
|
||||
* elf-bfd.h (struct elf_backend_data <get_reloc_section>): Change
|
||||
Index: git/bfd/elf.c
|
||||
===================================================================
|
||||
--- git.orig/bfd/elf.c 2017-09-20 12:54:44.847475928 +0530
|
||||
+++ git/bfd/elf.c 2017-09-20 13:00:22.636091768 +0530
|
||||
@@ -10986,9 +10986,11 @@
|
||||
|
||||
/* It is only used by x86-64 so far.
|
||||
??? This repeats *COM* id of zero. sec->id is supposed to be unique,
|
||||
- but current usage would allow all of _bfd_std_section to be zero. t*/
|
||||
+ but current usage would allow all of _bfd_std_section to be zero. */
|
||||
+static const asymbol lcomm_sym
|
||||
+ = GLOBAL_SYM_INIT ("LARGE_COMMON", &_bfd_elf_large_com_section);
|
||||
asection _bfd_elf_large_com_section
|
||||
- = BFD_FAKE_SECTION (_bfd_elf_large_com_section, NULL,
|
||||
+ = BFD_FAKE_SECTION (_bfd_elf_large_com_section, &lcomm_sym,
|
||||
"LARGE_COMMON", 0, SEC_IS_COMMON);
|
||||
|
||||
void
|
||||
@@ -0,0 +1,80 @@
|
||||
commit 821e6ff6299aa39e841ca50e1ae8a98e3554fd5f
|
||||
Author: Alan Modra <amodra@gmail.com>
|
||||
Date: Wed Oct 12 09:41:33 2016 +1030
|
||||
|
||||
BFD_FAKE_SECTION macro params
|
||||
|
||||
Order NAME, IDX, FLAGS as per STD_SECTION macro.
|
||||
|
||||
* section.c (BFD_FAKE_SECTION): Reorder parameters. Formatting.
|
||||
(STD_SECTION): Adjust to suit.
|
||||
* elf.c (_bfd_elf_large_com_section): Likewise.
|
||||
* bfd-in2.h: Regenerate.
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
CVE: CVE-2017-8394
|
||||
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
|
||||
|
||||
|
||||
Index: git/bfd/bfd-in2.h
|
||||
===================================================================
|
||||
--- git.orig/bfd/bfd-in2.h 2017-09-20 12:54:42.423465338 +0530
|
||||
+++ git/bfd/bfd-in2.h 2017-09-20 13:02:48.000000000 +0530
|
||||
@@ -1767,9 +1767,9 @@
|
||||
#define bfd_section_removed_from_list(ABFD, S) \
|
||||
((S)->next == NULL ? (ABFD)->section_last != (S) : (S)->next->prev != (S))
|
||||
|
||||
-#define BFD_FAKE_SECTION(SEC, FLAGS, SYM, NAME, IDX) \
|
||||
+#define BFD_FAKE_SECTION(SEC, SYM, NAME, IDX, FLAGS) \
|
||||
/* name, id, index, next, prev, flags, user_set_vma, */ \
|
||||
- { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \
|
||||
+ { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \
|
||||
\
|
||||
/* linker_mark, linker_has_input, gc_mark, decompress_status, */ \
|
||||
0, 0, 1, 0, \
|
||||
Index: git/bfd/elf.c
|
||||
===================================================================
|
||||
--- git.orig/bfd/elf.c 2017-09-20 12:54:44.503474440 +0530
|
||||
+++ git/bfd/elf.c 2017-09-20 13:02:48.000000000 +0530
|
||||
@@ -10984,10 +10984,12 @@
|
||||
return n;
|
||||
}
|
||||
|
||||
-/* It is only used by x86-64 so far. */
|
||||
+/* It is only used by x86-64 so far.
|
||||
+ ??? This repeats *COM* id of zero. sec->id is supposed to be unique,
|
||||
+ but current usage would allow all of _bfd_std_section to be zero. t*/
|
||||
asection _bfd_elf_large_com_section
|
||||
- = BFD_FAKE_SECTION (_bfd_elf_large_com_section,
|
||||
- SEC_IS_COMMON, NULL, "LARGE_COMMON", 0);
|
||||
+ = BFD_FAKE_SECTION (_bfd_elf_large_com_section, NULL,
|
||||
+ "LARGE_COMMON", 0, SEC_IS_COMMON);
|
||||
|
||||
void
|
||||
_bfd_elf_post_process_headers (bfd * abfd,
|
||||
Index: git/bfd/section.c
|
||||
===================================================================
|
||||
--- git.orig/bfd/section.c 2017-09-20 12:54:43.815471454 +0530
|
||||
+++ git/bfd/section.c 2017-09-20 13:02:48.000000000 +0530
|
||||
@@ -700,9 +700,9 @@
|
||||
.#define bfd_section_removed_from_list(ABFD, S) \
|
||||
. ((S)->next == NULL ? (ABFD)->section_last != (S) : (S)->next->prev != (S))
|
||||
.
|
||||
-.#define BFD_FAKE_SECTION(SEC, FLAGS, SYM, NAME, IDX) \
|
||||
+.#define BFD_FAKE_SECTION(SEC, SYM, NAME, IDX, FLAGS) \
|
||||
. {* name, id, index, next, prev, flags, user_set_vma, *} \
|
||||
-. { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \
|
||||
+. { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \
|
||||
. \
|
||||
. {* linker_mark, linker_has_input, gc_mark, decompress_status, *} \
|
||||
. 0, 0, 1, 0, \
|
||||
@@ -764,7 +764,7 @@
|
||||
};
|
||||
|
||||
#define STD_SECTION(NAME, IDX, FLAGS) \
|
||||
- BFD_FAKE_SECTION(_bfd_std_section[IDX], FLAGS, &global_syms[IDX], NAME, IDX)
|
||||
+ BFD_FAKE_SECTION(_bfd_std_section[IDX], &global_syms[IDX], NAME, IDX, FLAGS)
|
||||
|
||||
asection _bfd_std_section[] = {
|
||||
STD_SECTION (BFD_COM_SECTION_NAME, 0, SEC_IS_COMMON),
|
||||
Reference in New Issue
Block a user