mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-02-26 11:29:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

binutils: Fix CVE-2025-7546

Browse Source 
Report corrupted group section instead of trying to recover.

CVE: CVE-2025-7546
Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=41461010eb7c79fee7a9d5f6209accdaac66cc6b]
PR  33050 [https://sourceware.org/bugzilla/show_bug.cgi?id=33050]

(From OE-Core rev: e65073ff67e715999f6ab3906ead181e26c57360)

Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Yash Shinde
2025-07-16 05:46:09 -07:00
committed by Richard Purdie
parent dc28d83245
commit e5cc507a3e
2 changed files with 59 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
meta/recipes-devtools/binutils/binutils/0020-CVE-2025-7546.patch Normal file
View File

@@ -0,0 +1,58 @@
From 41461010eb7c79fee7a9d5f6209accdaac66cc6b Mon Sep 17 00:00:00 2001
From: "H.J. Lu" <hjl.tools@gmail.com>
Date: Sat, 21 Jun 2025 06:52:00 +0800
Subject: [PATCH] elf: Report corrupted group section
Report corrupted group section instead of trying to recover.
PR binutils/33050
* elf.c (bfd_elf_set_group_contents): Report corrupted group
section.
Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=41461010eb7c79fee7a9d5f6209accdaac66cc6b]
CVE: CVE-2025-7546
Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
---
bfd/elf.c | 23 ++++++++++-------------
1 file changed, 10 insertions(+), 13 deletions(-)
diff --git a/bfd/elf.c b/bfd/elf.c
index 14ce15c7254..ee894eb05f2 100644
--- a/bfd/elf.c
+++ b/bfd/elf.c
@@ -3971,20 +3971,17 @@ bfd_elf_set_group_contents (bfd *abfd, asection *sec, void *failedptrarg)
break;
}
- /* We should always get here with loc == sec->contents + 4, but it is
- possible to craft bogus SHT_GROUP sections that will cause segfaults
- in objcopy without checking loc here and in the loop above. */
- if (loc == sec->contents)
- BFD_ASSERT (0);
- else
+ /* We should always get here with loc == sec->contents + 4. Return
+ an error for bogus SHT_GROUP sections. */
+ loc -= 4;
+ if (loc != sec->contents)
{
- loc -= 4;
- if (loc != sec->contents)
- {
- BFD_ASSERT (0);
- memset (sec->contents + 4, 0, loc - sec->contents);
- loc = sec->contents;
- }
+ /* xgettext:c-format */
+ _bfd_error_handler (_("%pB: corrupted group section: `%pA'"),
+ abfd, sec);
+ bfd_set_error (bfd_error_bad_value);
+ *failedptr = true;
+ return;
}
H_PUT_32 (abfd, sec->flags & SEC_LINK_ONCE ? GRP_COMDAT : 0, loc);
--
2.43.5