mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-24 22:36:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

binutils: Fix CVE-2026-6846

Browse Source 
This patch applies the upstream fix as referenced in [2], using the commit shown in [1].

[1] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7a089e0302382f4d4e077941156e1eaa68d01393
[2] https://security-tracker.debian.org/tracker/CVE-2026-6846

(From OE-Core rev: c4773d5fb3b9d17c80c0ba717a07d113c3784249)

Signed-off-by: Shubham Pushpkar <spushpka@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Shubham Pushpkar
2026-06-01 07:49:01 -07:00
committed by Paul Barker
parent dbf61c2308
commit db642a22a1
2 changed files with 58 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/binutils/binutils-2.42.inc
View File

@@ -74,5 +74,6 @@ SRC_URI = "\
file://0030-CVE-2025-11840.patch \ file://0030-CVE-2025-11840.patch \
file://CVE-2025-69644-CVE-2025-69647.patch \ file://CVE-2025-69644-CVE-2025-69647.patch \
file://CVE-2025-69648.patch \ file://CVE-2025-69648.patch \
file://CVE-2026-6846.patch \
" "
S = "${WORKDIR}/git" S = "${WORKDIR}/git"

57
meta/recipes-devtools/binutils/binutils/CVE-2026-6846.patch Normal file
View File

@@ -0,0 +1,57 @@
From 2a340616f7e6591f83e85777d1d1f6108c33f5b8 Mon Sep 17 00:00:00 2001
From: Alan Modra <amodra@gmail.com>
Date: Mon, 6 Apr 2026 22:58:22 +0930
Subject: [PATCH] PR 34049 buffer overflow in xcoff_link_add_symbols
The fact that coffcode.h:coff_set_alignment_hook for rs6000 removes
sections can result in target_index > section_count. Thus any array
indexed by target_index must not be sized by section_count.
PR ld/34049
* xcofflink.c (xcoff_link_add_symbols): Size reloc_info array
using max target_index.
CVE: CVE-2026-6846
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=7a089e0302382f4d4e077941156e1eaa68d01393]
(cherry picked from commit 7a089e0302382f4d4e077941156e1eaa68d01393)
Signed-off-by: Shubham Pushpkar <spushpka@cisco.com>
---
bfd/xcofflink.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/bfd/xcofflink.c b/bfd/xcofflink.c
index 6ef9abcd8..196967ed0 100644
--- a/bfd/xcofflink.c
+++ b/bfd/xcofflink.c
@@ -1300,6 +1300,7 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
} *reloc_info = NULL;
bfd_size_type amt;
unsigned short visibility;
+ unsigned int max_target_index;
keep_syms = obj_coff_keep_syms (abfd);
@@ -1363,7 +1364,19 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
order by VMA within a given section, so we handle this by
scanning along the relocs as we process the csects. We index
into reloc_info using the section target_index. */
- amt = abfd->section_count + 1;
+ max_target_index = 0;
+ for (o = abfd->section_last; o != NULL; o = o->prev)
+ if (o->target_index != 0)
+ {
+ /* The last section added from the object file will have the
+ highest target_index. See coffgen.c coff_real_object_p and
+ make_a_section_from_file. Sections added by
+ xcoff_link_create_extra_sections will have a zero
+ target_index. */
+ max_target_index = o->target_index;
+ break;
+ }
+ amt = max_target_index + 1;
amt *= sizeof (struct reloc_info_struct);
reloc_info = bfd_zmalloc (amt);
if (reloc_info == NULL)
--
2.35.6