mirror of
https://git.yoctoproject.org/poky
synced 2026-03-04 06:19:40 +01:00
0aa12e4919
Fix below CVE's CVE-2022-47007 CVE-2022-47008 CVE-2022-47010 CVE-2022-47011 CVE-2022-48063 CVE-2022-47695 (From OE-Core rev: 873163936937a583278e3cd97c6226935f2faa0c) Signed-off-by: Virendra Thakur <virendrak@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
58 lines
2.2 KiB
Diff
58 lines
2.2 KiB
Diff
From 3d3af4ba39e892b1c544d667ca241846bc3df386 Mon Sep 17 00:00:00 2001
|
|
From: Alan Modra <amodra@gmail.com>
|
|
Date: Sun, 4 Dec 2022 22:15:40 +1030
|
|
Subject: [PATCH] PR29846, segmentation fault in objdump.c compare_symbols
|
|
|
|
Fixes a fuzzed object file problem where plt relocs were manipulated
|
|
in such a way that two synthetic symbols were generated at the same
|
|
plt location. Won't occur in real object files.
|
|
|
|
PR 29846
|
|
PR 20337
|
|
* objdump.c (compare_symbols): Test symbol flags to exclude
|
|
section and synthetic symbols before attempting to check flavour.
|
|
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=3d3af4ba39e892b1c544d667ca241846bc3df386]
|
|
CVE: CVE-2022-47695
|
|
Signed-off-by: Virendra Thakur <virendrak@kpit.com>
|
|
Comment: Patch refreshed based on codebase.
|
|
---
|
|
binutils/objdump.c | 23 ++++++++++-------------
|
|
1 file changed, 10 insertions(+), 13 deletions(-)
|
|
|
|
diff --git a/binutils/objdump.c b/binutils/objdump.c
|
|
index e8481b2d928..d95c8b68bf0 100644
|
|
--- a/binutils/objdump.c
|
|
+++ b/binutils/objdump.c
|
|
@@ -935,20 +935,17 @@
|
|
return 1;
|
|
}
|
|
|
|
- if (bfd_get_flavour (bfd_asymbol_bfd (a)) == bfd_target_elf_flavour
|
|
+ /* Sort larger size ELF symbols before smaller. See PR20337. */
|
|
+ bfd_vma asz = 0;
|
|
+ if ((a->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0
|
|
+ && bfd_get_flavour (bfd_asymbol_bfd (a)) == bfd_target_elf_flavour)
|
|
+ asz = ((elf_symbol_type *) a)->internal_elf_sym.st_size;
|
|
+ bfd_vma bsz = 0;
|
|
+ if ((b->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0
|
|
&& bfd_get_flavour (bfd_asymbol_bfd (b)) == bfd_target_elf_flavour)
|
|
- {
|
|
- bfd_vma asz, bsz;
|
|
-
|
|
- asz = 0;
|
|
- if ((a->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0)
|
|
- asz = ((elf_symbol_type *) a)->internal_elf_sym.st_size;
|
|
- bsz = 0;
|
|
- if ((b->flags & (BSF_SECTION_SYM | BSF_SYNTHETIC)) == 0)
|
|
- bsz = ((elf_symbol_type *) b)->internal_elf_sym.st_size;
|
|
- if (asz != bsz)
|
|
- return asz > bsz ? -1 : 1;
|
|
- }
|
|
+ bsz = ((elf_symbol_type *) b)->internal_elf_sym.st_size;
|
|
+ if (asz != bsz)
|
|
+ return asz > bsz ? -1 : 1;
|
|
|
|
/* Symbols that start with '.' might be section names, so sort them
|
|
after symbols that don't start with '.'. */
|
|
|