mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-01-29 21:08:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

binutils : Fix CVE-2023-25585

Browse Source 
Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=65cf035b8dc1df5d8020e0b1449514a3c42933e7]

(From OE-Core rev: 033db4876844b17de7673970860eb155d15c56e7)

Signed-off-by: Deepthi Hemraj <deepadeepthi98@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Deepthi Hemraj
2023-05-03 17:25:15 +05:30
committed by Steve Sakoman
parent 614a9a6f9f
commit 2d215bee87
2 changed files with 55 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/binutils/binutils-2.38.inc
View File

@@ -53,5 +53,6 @@ SRC_URI = "\
file://0022-CVE-2023-25584-1.patch \
file://0022-CVE-2023-25584-2.patch \
file://0022-CVE-2023-25584-3.patch \
file://0023-CVE-2023-25585.patch \
"
S = "${WORKDIR}/git"

54
meta/recipes-devtools/binutils/binutils/0023-CVE-2023-25585.patch Normal file
View File

@@ -0,0 +1,54 @@
From: Alan Modra <amodra@gmail.com>
Date: Mon, 12 Dec 2022 08:31:08 +0000 (+1030)
Subject: PR29892, Field file_table of struct module is uninitialized
X-Git-Tag: gdb-13-branchpoint~86
X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=65cf035b8dc1df5d8020e0b1449514a3c42933e7
PR29892, Field file_table of struct module is uninitialized
PR 29892
* vms-alphs.c (new_module): Use bfd_zmalloc to alloc file_table.
(parse_module): Rewrite file_table reallocation code and clear.
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=65cf035b8dc1df5d8020e0b1449514a3c42933e7]
CVE: CVE-2023-25585
Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
---
diff --git a/bfd/vms-alpha.c b/bfd/vms-alpha.c
index 3b63259cc81..6ee7060b0b2 100644
--- a/bfd/vms-alpha.c
+++ b/bfd/vms-alpha.c
@@ -4337,7 +4337,7 @@ new_module (bfd *abfd)
= (struct module *) bfd_zalloc (abfd, sizeof (struct module));
module->file_table_count = 16; /* Arbitrary. */
module->file_table
- = bfd_malloc (module->file_table_count * sizeof (struct fileinfo));
+ = bfd_zmalloc (module->file_table_count * sizeof (struct fileinfo));
return module;
}
@@ -4520,15 +4520,18 @@ parse_module (bfd *abfd, struct module *module, unsigned char *ptr,
src_ptr + DST_S_B_SRC_DF_FILENAME,
ptr + rec_length - (src_ptr + DST_S_B_SRC_DF_FILENAME));
- while (fileid >= module->file_table_count)
+ if (fileid >= module->file_table_count)
{
- module->file_table_count *= 2;
+ unsigned int old_count = module->file_table_count;
+ module->file_table_count += fileid;
module->file_table
= bfd_realloc_or_free (module->file_table,
module->file_table_count
* sizeof (struct fileinfo));
if (module->file_table == NULL)
return false;
+ memset (module->file_table + old_count, 0,
+ fileid * sizeof (struct fileinfo));
}
module->file_table [fileid].name = filename;