mirror of
https://git.yoctoproject.org/poky
synced 2026-04-30 21:32:13 +02:00
0118bd1e10
CVE: CVE-2025-11081 Trying to dump .sframe in a PE file results in a segfault accessing elf_section_data. * objdump (dump_sframe_section, dump_dwarf_section): Don't access elf_section_type without first checking the file is ELF. PR 33406 SEGV in dump_dwarf_section [https://sourceware.org/bugzilla/show_bug.cgi?id=33406] Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=f87a66db645caf8cc0e6fc87b0c28c78a38af59b] (From OE-Core rev: a7d39d40ec867bbcc36d71cf98858a34c619c9fe) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
85 lines
3.0 KiB
Diff
85 lines
3.0 KiB
Diff
From f87a66db645caf8cc0e6fc87b0c28c78a38af59b Mon Sep 17 00:00:00 2001
|
|
From: Alan Modra <amodra@gmail.com>
|
|
Date: Tue, 9 Sep 2025 18:32:09 +0930
|
|
Subject: [PATCH] PR 33406 SEGV in dump_dwarf_section
|
|
|
|
Trying to dump .sframe in a PE file results in a segfault accessing
|
|
elf_section_data.
|
|
|
|
* objdump (dump_sframe_section, dump_dwarf_section): Don't access
|
|
elf_section_type without first checking the file is ELF.
|
|
---
|
|
binutils/objdump.c | 10 ++++++----
|
|
1 file changed, 6 insertions(+), 4 deletions(-)
|
|
|
|
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=f87a66db645caf8cc0e6fc87b0c28c78a38af59b]
|
|
CVE: CVE-2025-11081
|
|
|
|
Signed-off-by: Alan Modra <amodra@gmail.com>
|
|
Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
|
|
|
|
diff --git a/binutils/objdump.c b/binutils/objdump.c
|
|
index 290f7e51f66..ee8823da05a 100644
|
|
--- a/binutils/objdump.c
|
|
+++ b/binutils/objdump.c
|
|
@@ -4418,6 +4418,10 @@
|
|
else
|
|
match = name;
|
|
|
|
+ if (bfd_get_flavour (abfd) == bfd_target_elf_flavour
|
|
+ && elf_section_type (section) == SHT_GNU_SFRAME)
|
|
+ match = ".sframe";
|
|
+
|
|
for (i = 0; i < max; i++)
|
|
if ((strcmp (debug_displays [i].section.uncompressed_name, match) == 0
|
|
|| strcmp (debug_displays [i].section.compressed_name, match) == 0
|
|
@@ -4923,6 +4927,36 @@
|
|
}
|
|
|
|
+static void
|
|
+dump_sframe_section (bfd *abfd, const char *sect_name, bool is_mainfile)
|
|
+
|
|
+{
|
|
+ /* Error checking for user provided SFrame section name, if any. */
|
|
+ if (sect_name)
|
|
+ {
|
|
+ asection *sec = bfd_get_section_by_name (abfd, sect_name);
|
|
+ if (sec == NULL)
|
|
+ {
|
|
+ printf (_("No %s section present\n\n"), sanitize_string (sect_name));
|
|
+ return;
|
|
+ }
|
|
+ /* Starting with Binutils 2.45, SFrame sections have section type
|
|
+ SHT_GNU_SFRAME. For SFrame sections from Binutils 2.44 or earlier,
|
|
+ check explcitly for SFrame sections of type SHT_PROGBITS and name
|
|
+ ".sframe" to allow them. */
|
|
+ else if (bfd_get_flavour (abfd) != bfd_target_elf_flavour
|
|
+ || (elf_section_type (sec) != SHT_GNU_SFRAME
|
|
+ && !(elf_section_type (sec) == SHT_PROGBITS
|
|
+ && strcmp (sect_name, ".sframe") == 0)))
|
|
+ {
|
|
+ printf (_("Section %s does not contain SFrame data\n\n"),
|
|
+ sanitize_string (sect_name));
|
|
+ return;
|
|
+ }
|
|
+ }
|
|
+ dump_dwarf (abfd, is_mainfile);
|
|
+}
|
|
+
|
|
static void
|
|
dump_target_specific (bfd *abfd)
|
|
{
|
|
const struct objdump_private_desc * const *desc;
|
|
diff --git a/include/elf/common.h b/include/elf/common.h
|
|
--- a/include/elf/common.h
|
|
+++ b/include/elf/common.h
|
|
@@ -528,6 +528,8 @@
|
|
#define SHT_LOOS 0x60000000 /* First of OS specific semantics */
|
|
#define SHT_HIOS 0x6fffffff /* Last of OS specific semantics */
|
|
|
|
+#define SHT_GNU_SFRAME 0x6ffffff4 /* SFrame stack trace information. */
|
|
+
|
|
#define SHT_GNU_INCREMENTAL_INPUTS 0x6fff4700 /* incremental build data */
|
|
#define SHT_GNU_ATTRIBUTES 0x6ffffff5 /* Object attributes */
|
|
#define SHT_GNU_HASH 0x6ffffff6 /* GNU style symbol hash table */
|