mirror of
https://git.yoctoproject.org/poky
synced 2026-01-29 21:08:42 +01:00
aaf9219788
Pick commit per NVD CVE report. (From OE-Core rev: 6b94ff6c584a31d2b1e06d1e1dc19392d759b4b7) (From OE-Core rev: 9130f3471f4814979cfdfa66ca118929f240cb30) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
36 lines
1.4 KiB
Diff
36 lines
1.4 KiB
Diff
From 047435dd988a3975d40c6626a8f739a0b2e154bc Mon Sep 17 00:00:00 2001
|
|
From: Alan Modra <amodra@gmail.com>
|
|
Date: Thu, 25 Sep 2025 08:22:24 +0930
|
|
Subject: [PATCH] PR 33452 SEGV in bfd_elf_gc_record_vtentry
|
|
|
|
Limit addends on vtentry relocs, otherwise ld might attempt to
|
|
allocate a stupidly large array. This also fixes the expression
|
|
overflow leading to pr33452. A vtable of 33M entries on a 64-bit
|
|
host is surely large enough, especially considering that VTINHERIT
|
|
and VTENTRY relocations are to support -fvtable-gc that disappeared
|
|
from gcc over 20 years ago.
|
|
|
|
PR ld/33452
|
|
* elflink.c (bfd_elf_gc_record_vtentry): Sanity check addend.
|
|
|
|
CVE: CVE-2025-11412
|
|
Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=047435dd988a3975d40c6626a8f739a0b2e154bc]
|
|
Signed-off-by: Peter Marko <peter.marko@siemens.com>
|
|
---
|
|
bfd/elflink.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/bfd/elflink.c b/bfd/elflink.c
|
|
index 54f0d6e957e..0a0456177c2 100644
|
|
--- a/bfd/elflink.c
|
|
+++ b/bfd/elflink.c
|
|
@@ -14407,7 +14407,7 @@ bfd_elf_gc_record_vtentry (bfd *abfd, asection *sec,
|
|
const struct elf_backend_data *bed = get_elf_backend_data (abfd);
|
|
unsigned int log_file_align = bed->s->log_file_align;
|
|
|
|
- if (!h)
|
|
+ if (!h || addend > 1u << 28)
|
|
{
|
|
/* xgettext:c-format */
|
|
_bfd_error_handler (_("%pB: section '%pA': corrupt VTENTRY entry"),
|