mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-01-29 21:08:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

binutils: Fix CVE-2025-0840

Browse Source 
PR32560 stack-buffer-overflow at objdump disassemble_bytes

Backport a patch from upstream to fix CVE-2025-0840
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=baac6c221e9d69335bf41366a1c7d87d8ab2f893]

(From OE-Core rev: e12ee4b1713aa25465aa3f866d345d84e9eb948a)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Deepesh Varatharajan
2025-03-06 02:48:06 -08:00
committed by Steve Sakoman
parent 079c58a500
commit e9f1ad6922
2 changed files with 54 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/binutils/binutils-2.38.inc
View File

@@ -72,5 +72,6 @@ SRC_URI = "\
file://0035-CVE-2023-39129.patch \
file://0036-CVE-2023-39130.patch \
file://0037-CVE-2024-53589.patch \
file://0038-CVE-2025-0840.patch \
"
S = "${WORKDIR}/git"

53
meta/recipes-devtools/binutils/binutils/0038-CVE-2025-0840.patch Normal file
View File

@@ -0,0 +1,53 @@
Author: Alan Modra <amodra@gmail.com>
Date: Wed, 15 Jan 2025 19:13:43 +1030
PR32560 stack-buffer-overflow at objdump disassemble_bytes
There's always someone pushing the boundaries.
PR 32560
* objdump.c (MAX_INSN_WIDTH): Define.
(insn_width): Make it an unsigned long.
(disassemble_bytes): Use MAX_INSN_WIDTH to size buffer.
(main <OPTION_INSN_WIDTH>): Restrict size of insn_width.
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=baac6c221e9d69335bf41366a1c7d87d8ab2f893]
CVE: CVE-2025-0840
Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
diff --git a/binutils/objdump.c b/binutils/objdump.c
index 59f454b0..bd6180be 100644
--- a/binutils/objdump.c
+++ b/binutils/objdump.c
@@ -110,7 +110,8 @@ static bool disassemble_all; /* -D */
static int disassemble_zeroes; /* --disassemble-zeroes */
static bool formats_info; /* -i */
static int wide_output; /* -w */
-static int insn_width; /* --insn-width */
+#define MAX_INSN_WIDTH 49
+static unsigned long insn_width; /* --insn-width */
static bfd_vma start_address = (bfd_vma) -1; /* --start-address */
static bfd_vma stop_address = (bfd_vma) -1; /* --stop-address */
static int dump_debugging; /* --debugging */
@@ -2897,7 +2898,7 @@ disassemble_bytes (struct disassemble_info *inf,
}
else
{
- char buf[50];
+ char buf[MAX_INSN_WIDTH + 1];
unsigned int bpc = 0;
unsigned int pb = 0;
@@ -5457,8 +5458,9 @@ main (int argc, char **argv)
break;
case OPTION_INSN_WIDTH:
insn_width = strtoul (optarg, NULL, 0);
- if (insn_width <= 0)
- fatal (_("error: instruction width must be positive"));
+ if (insn_width - 1 >= MAX_INSN_WIDTH)
+ fatal (_("error: instruction width must be in the range 1 to "
+ XSTRING (MAX_INSN_WIDTH)));
break;
case OPTION_INLINES:
unwind_inlines = true;