mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-23 00:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

binutils: Fix CVE-2022-47695

Browse Source 
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=3d3af4ba39e892b1c544d667ca241846bc3df386]

(From OE-Core rev: 4d4732c2e295fea610d266fa12bae3cc01f93dfa)

Signed-off-by: Chaitanya Vadrevu <chaitanya.vadrevu@ni.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Chaitanya Vadrevu
2023-10-13 19:27:17 -05:00
committed by Steve Sakoman
parent 47d212a57f
commit 4537f28311
2 changed files with 59 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/binutils/binutils-2.38.inc
View File

@@ -62,5 +62,6 @@ SRC_URI = "\
file://0030-CVE-2022-44840.patch \
file://0031-CVE-2022-45703-1.patch \
file://0031-CVE-2022-45703-2.patch \
file://0031-CVE-2022-47695.patch \
"
S = "${WORKDIR}/git"

58
meta/recipes-devtools/binutils/binutils/0031-CVE-2022-47695.patch Normal file
View File

@@ -0,0 +1,58 @@
From 2f7426b9bb2d2450b32cad3d79fab9abe3ec42bb Mon Sep 17 00:00:00 2001
From: Alan Modra <amodra@gmail.com>
Date: Sun, 4 Dec 2022 22:15:40 +1030
Subject: [PATCH] PR29846, segmentation fault in objdump.c compare_symbols
Fixes a fuzzed object file problem where plt relocs were manipulated
in such a way that two synthetic symbols were generated at the same
plt location. Won't occur in real object files.
PR 29846
PR 20337
* objdump.c (compare_symbols): Test symbol flags to exclude
section and synthetic symbols before attempting to check flavour.
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=3d3af4ba39e892b1c544d667ca241846bc3df386]
CVE: CVE-2022-47695
Signed-off-by: Chaitanya Vadrevu <chaitanya.vadrevu@ni.com>
---
binutils/objdump.c | 23 ++++++++++-------------
1 file changed, 10 insertions(+), 13 deletions(-)
diff --git a/binutils/objdump.c b/binutils/objdump.c
index 08a0fe521d8..21f75f4db40 100644
--- a/binutils/objdump.c
+++ b/binutils/objdump.c
@@ -1165,20 +1165,17 @@ compare_symbols (const void *ap, const void *bp)
return 1;
}
- if (bfd_get_flavour (bfd_asymbol_bfd (a)) == bfd_target_elf_flavour
+ /* Sort larger size ELF symbols before smaller. See PR20337. */
+ bfd_vma asz = 0;
+ if ((a->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0
+ && bfd_get_flavour (bfd_asymbol_bfd (a)) == bfd_target_elf_flavour)
+ asz = ((elf_symbol_type *) a)->internal_elf_sym.st_size;
+ bfd_vma bsz = 0;
+ if ((b->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0
&& bfd_get_flavour (bfd_asymbol_bfd (b)) == bfd_target_elf_flavour)
- {
- bfd_vma asz, bsz;
-
- asz = 0;
- if ((a->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0)
- asz = ((elf_symbol_type *) a)->internal_elf_sym.st_size;
- bsz = 0;
- if ((b->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0)
- bsz = ((elf_symbol_type *) b)->internal_elf_sym.st_size;
- if (asz != bsz)
- return asz > bsz ? -1 : 1;
- }
+ bsz = ((elf_symbol_type *) b)->internal_elf_sym.st_size;
+ if (asz != bsz)
+ return asz > bsz ? -1 : 1;
/* Symbols that start with '.' might be section names, so sort them
after symbols that don't start with '.'. */