diff options
Diffstat (limited to 'poky/meta/recipes-devtools/binutils')
5 files changed, 122 insertions, 2 deletions
diff --git a/poky/meta/recipes-devtools/binutils/binutils-2.40.inc b/poky/meta/recipes-devtools/binutils/binutils-2.40.inc index dbb43044a4..424cfc48fc 100644 --- a/poky/meta/recipes-devtools/binutils/binutils-2.40.inc +++ b/poky/meta/recipes-devtools/binutils/binutils-2.40.inc @@ -18,7 +18,7 @@ SRCBRANCH ?= "binutils-2_40-branch" UPSTREAM_CHECK_GITTAGREGEX = "binutils-(?P<pver>\d+_(\d_?)*)" -SRCREV ?= "4671be001eb5a899ecac3e2686a92934000f8262" +SRCREV ?= "391fd4d9ee5d2b78244cbcd57fc405738359b70b" BINUTILS_GIT_URI ?= "git://sourceware.org/git/binutils-gdb.git;branch=${SRCBRANCH};protocol=https" SRC_URI = "\ ${BINUTILS_GIT_URI} \ @@ -34,5 +34,7 @@ SRC_URI = "\ file://0013-Define-alignof-using-_Alignof-when-using-C11-or-newe.patch \ file://0015-Remove-duplicate-pe-dll.o-entry-deom-targ_extra_ofil.patch \ file://0016-CVE-2023-25586.patch \ + file://0001-Fix-an-illegal-memory-access-when-an-accessing-a-zer.patch \ + file://0017-CVE-2023-39128.patch \ " S = "${WORKDIR}/git" diff --git a/poky/meta/recipes-devtools/binutils/binutils.inc b/poky/meta/recipes-devtools/binutils/binutils.inc index c69d29448f..e176b5cff1 100644 --- a/poky/meta/recipes-devtools/binutils/binutils.inc +++ b/poky/meta/recipes-devtools/binutils/binutils.inc @@ -33,6 +33,8 @@ FILES:${PN}-dev = " \ ${libdir}/libctf-nobfd.so \ ${libdir}/libopcodes.so" +FILES:${PN}-staticdev += "${libdir}/gprofng/*.a" + # Rather than duplicating multiple entries for these, make one # list and reuse it. diff --git a/poky/meta/recipes-devtools/binutils/binutils/0001-Fix-an-illegal-memory-access-when-an-accessing-a-zer.patch b/poky/meta/recipes-devtools/binutils/binutils/0001-Fix-an-illegal-memory-access-when-an-accessing-a-zer.patch new file mode 100644 index 0000000000..31157cacd2 --- /dev/null +++ b/poky/meta/recipes-devtools/binutils/binutils/0001-Fix-an-illegal-memory-access-when-an-accessing-a-zer.patch @@ -0,0 +1,43 @@ +From c22d38baefc5a7a1e1f5cdc9dbb556b1f0ec5c57 Mon Sep 17 00:00:00 2001 +From: Nick Clifton <nickc@redhat.com> +Date: Thu, 30 Mar 2023 10:10:09 +0100 +Subject: [PATCH] Fix an illegal memory access when an accessing a + zer0-lengthverdef table. + + PR 30285 + * elf.c (_bfd_elf_slurp_version_tables): Fail if no version definitions are allocated. + +CVE: CVE-2023-1972 +Upstream-Status: Backport +Signed-off-by: Ross Burton <ross.burton@arm.com> +--- + bfd/ChangeLog | 6 ++++++ + bfd/elf.c | 5 +++++ + 2 files changed, 11 insertions(+) + +diff --git a/bfd/elf.c b/bfd/elf.c +index 027d0143735..185028cbd97 100644 +--- a/bfd/elf.c ++++ b/bfd/elf.c +@@ -9030,6 +9030,9 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver) + bfd_set_error (bfd_error_file_too_big); + goto error_return_verdef; + } ++ ++ if (amt == 0) ++ goto error_return_verdef; + elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt); + if (elf_tdata (abfd)->verdef == NULL) + goto error_return_verdef; +@@ -9133,6 +9136,8 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver) + bfd_set_error (bfd_error_file_too_big); + goto error_return; + } ++ if (amt == 0) ++ goto error_return; + elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt); + if (elf_tdata (abfd)->verdef == NULL) + goto error_return; +-- +2.34.1 + diff --git a/poky/meta/recipes-devtools/binutils/binutils/0017-CVE-2023-39128.patch b/poky/meta/recipes-devtools/binutils/binutils/0017-CVE-2023-39128.patch new file mode 100644 index 0000000000..cd81a52b15 --- /dev/null +++ b/poky/meta/recipes-devtools/binutils/binutils/0017-CVE-2023-39128.patch @@ -0,0 +1,74 @@ +From: Tom Tromey <tromey@adacore.com> +Date: Wed, 16 Aug 2023 17:29:19 +0000 (-0600) +Subject: Avoid buffer overflow in ada_decode +X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=033bc52bb6190393c8eed80925fa78cc35b40c6d + +Avoid buffer overflow in ada_decode + +A bug report pointed out a buffer overflow in ada_decode, which Keith +helpfully analyzed. ada_decode had a logic error when the input was +all digits. While this isn't valid -- and would probably only appear +in fuzzer tests -- it still should be handled properly. + +This patch adds a missing bounds check. Tested with the self-tests in +an asan build. + +Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=30639 +Reviewed-by: Keith Seitz <keiths@redhat.com> +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=033bc52bb6190393c8eed80925fa78cc35b40c6d] + +CVE: CVE-2023-39128 + +Signed-off-by: Sanjana Venkatesh <Sanjana.Venkatesh@windriver.com> + +--- + +diff --git a/gdb/ada-lang.c b/gdb/ada-lang.c +index 4a9a6e0f38f..2f934b1e79a 100644 +--- a/gdb/ada-lang.c ++++ b/gdb/ada-lang.c +@@ -57,6 +57,7 @@ + #include "cli/cli-utils.h" + #include "gdbsupport/function-view.h" + #include "gdbsupport/byte-vector.h" ++#include "gdbsupport/selftest.h" + #include <algorithm> + #include "ada-exp.h" + #include "charset.h" +@@ -1377,7 +1378,7 @@ ada_decode (const char *encoded, bool wrap, bool operators) + i -= 1; + if (i > 1 && encoded[i] == '_' && encoded[i - 1] == '_') + len0 = i - 1; +- else if (encoded[i] == '$') ++ else if (i >= 0 && encoded[i] == '$') + len0 = i; + } + +@@ -1574,6 +1575,18 @@ Suppress: + return decoded; + } + ++#ifdef GDB_SELF_TEST ++ ++static void ++ada_decode_tests () ++{ ++ /* This isn't valid, but used to cause a crash. PR gdb/30639. The ++ result does not really matter very much. */ ++ SELF_CHECK (ada_decode ("44") == "44"); ++} ++ ++#endif ++ + /* Table for keeping permanent unique copies of decoded names. Once + allocated, names in this table are never released. While this is a + storage leak, it should not be significant unless there are massive +@@ -13984,4 +13997,8 @@ DWARF attribute."), + gdb::observers::new_objfile.attach (ada_new_objfile_observer, "ada-lang"); + gdb::observers::free_objfile.attach (ada_free_objfile_observer, "ada-lang"); + gdb::observers::inferior_exit.attach (ada_inferior_exit, "ada-lang"); ++ ++#ifdef GDB_SELF_TEST ++ selftests::register_test ("ada-decode", ada_decode_tests); ++#endif + } diff --git a/poky/meta/recipes-devtools/binutils/binutils_2.40.bb b/poky/meta/recipes-devtools/binutils/binutils_2.40.bb index 9fe4bf5ae3..4ce1b4bec2 100644 --- a/poky/meta/recipes-devtools/binutils/binutils_2.40.bb +++ b/poky/meta/recipes-devtools/binutils/binutils_2.40.bb @@ -67,7 +67,6 @@ FILES:libbfd = "${libdir}/libbfd-*.so.* ${libdir}/libbfd-*.so" FILES:libopcodes = "${libdir}/libopcodes-*.so.* ${libdir}/libopcodes-*.so" FILES:gprofng = "${sysconfdir}/gprofng.rc ${libdir}/gprofng/libgp-*.so ${libdir}/gprofng/libgprofng.so.* ${bindir}/gp-* ${bindir}/gprofng" FILES:${PN}-dev += "${libdir}/libgprofng.so ${libdir}/libsframe.so" -FILES:${PN}-staticdev += "${libdir}/gprofng/*.a" SRC_URI:append:class-nativesdk = " file://0003-binutils-nativesdk-Search-for-alternative-ld.so.conf.patch " USE_ALTERNATIVES_FOR:class-nativesdk = "" |