tamiko 17/06/06 22:17:49
Modified: README.history
Added: 00_all_0007-CVE-2017-8398.patch
00_all_0008-CVE-2017-8393.patch
00_all_0009-CVE-2017-8394.patch
00_all_0010-CVE-2017-8395.patch
00_all_0011-CVE-2017-8396-CVE-2017-8397.patch
00_all_0012-CVE-2017-8421.patch
00_all_0013-CVE-2017-9038.patch
00_all_0014-CVE-2017-9039.patch
00_all_0015-CVE-2017-9040-CVE-2017-9042.patch
00_all_0016-CVE-2017-9041.patch
00_all_0017-CVE-2017-7614.patch
Log:
binutils-2.28: Update to patchset 1.1
Revision Changes Path
1.2 src/patchsets/binutils/2.28/README.history
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/README.history?rev=1.2&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/README.history?rev=1.2&content-type=text/plain
diff :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/README.history?r1=1.1&r2=1.2
Index: README.history
===================================================================
RCS file: /var/cvsroot/gentoo/src/patchsets/binutils/2.28/README.history,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- README.history 3 Mar 2017 18:31:08 -0000 1.1
+++ README.history 6 Jun 2017 22:17:49 -0000 1.2
@@ -1,3 +1,16 @@
+1.1 06 Jun 2017
+ + 00_all_0007-CVE-2017-8398.patch
+ + 00_all_0008-CVE-2017-8393.patch
+ + 00_all_0009-CVE-2017-8394.patch
+ + 00_all_0010-CVE-2017-8395.patch
+ + 00_all_0011-CVE-2017-8396-CVE-2017-8397.patch
+ + 00_all_0012-CVE-2017-8421.patch
+ + 00_all_0013-CVE-2017-9038.patch
+ + 00_all_0014-CVE-2017-9039.patch
+ + 00_all_0015-CVE-2017-9040-CVE-2017-9042.patch
+ + 00_all_0016-CVE-2017-9041.patch
+ + 00_all_0017-CVE-2017-7614.patch
+
1.0 03 Mar 2017
+ 00_all_0001-ld-always-warn-about-textrels-in-files.patch
+ 00_all_0002-gold-ld-add-support-for-poisoned-system-directories.patch
1.1 src/patchsets/binutils/2.28/00_all_0007-CVE-2017-8398.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0007-CVE-2017-8398.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0007-CVE-2017-8398.patch?rev=1.1&content-type=text/plain
Index: 00_all_0007-CVE-2017-8398.patch
===================================================================
>From 9e7b0cc09e3b8a9db2fdab786894757b7e1aab4c Mon Sep 17 00:00:00 2001
From: Matthias Maier <[email protected]>
Date: Tue, 6 Jun 2017 16:07:32 -0500
Subject: [PATCH 01/10] CVE-2017-8398
[1]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d949ff5607b9f595e0eed2ff15fbe5eb84eb3a34
[2] https://bugs.gentoo.org/show_bug.cgi?id=618514
---
binutils/dwarf.c | 52 ++++++++++++++++++++++++++++++++++++++--------------
1 file changed, 38 insertions(+), 14 deletions(-)
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 0184a7a..05efa6e 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -473,15 +473,20 @@ process_extended_line_op (unsigned char * data,
printf (_(" Entry\tDir\tTime\tSize\tName\n"));
printf (" %d\t", ++state_machine_regs.last_file_entry);
- name = data;
- data += strnlen ((char *) data, end - data) + 1;
- printf ("%s\t", dwarf_vmatoa ("u", read_uleb128 (data, & bytes_read,
end)));
- data += bytes_read;
- printf ("%s\t", dwarf_vmatoa ("u", read_uleb128 (data, & bytes_read,
end)));
- data += bytes_read;
- printf ("%s\t", dwarf_vmatoa ("u", read_uleb128 (data, & bytes_read,
end)));
- data += bytes_read;
- printf ("%s\n\n", name);
+ {
+ size_t l;
+
+ name = data;
+ l = strnlen ((char *) data, end - data);
+ data += len + 1;
+ printf ("%s\t", dwarf_vmatoa ("u", read_uleb128 (data, & bytes_read,
end)));
+ data += bytes_read;
+ printf ("%s\t", dwarf_vmatoa ("u", read_uleb128 (data, & bytes_read,
end)));
+ data += bytes_read;
+ printf ("%s\t", dwarf_vmatoa ("u", read_uleb128 (data, & bytes_read,
end)));
+ data += bytes_read;
+ printf ("%.*s\n\n", (int) l, name);
+ }
if (((unsigned int) (data - orig_data) != len) || data == end)
warn (_("DW_LNE_define_file: Bad opcode length\n"));
@@ -598,18 +603,28 @@ static const unsigned char *
fetch_indirect_string (dwarf_vma offset)
{
struct dwarf_section *section = &debug_displays [str].section;
+ const unsigned char * ret;
if (section->start == NULL)
return (const unsigned char *) _("<no .debug_str section>");
- if (offset > section->size)
+ if (offset >= section->size)
{
warn (_("DW_FORM_strp offset too big: %s\n"),
dwarf_vmatoa ("x", offset));
return (const unsigned char *) _("<offset is too big>");
}
- return (const unsigned char *) section->start + offset;
+ ret = section->start + offset;
+ /* Unfortunately we cannot rely upon the .debug_str section ending with a
+ NUL byte. Since our caller is expecting to receive a well formed C
+ string we test for the lack of a terminating byte here. */
+ if (strnlen ((const char *) ret, section->size - offset)
+ == section->size - offset)
+ ret = (const unsigned char *)
+ _("<no NUL byte at end of .debug_str section>");
+
+ return ret;
}
static const char *
@@ -622,6 +637,7 @@ fetch_indexed_string (dwarf_vma idx, struct cu_tu_set
*this_set,
struct dwarf_section *str_section = &debug_displays [str_sec_idx].section;
dwarf_vma index_offset = idx * offset_size;
dwarf_vma str_offset;
+ const char * ret;
if (index_section->start == NULL)
return (dwo ? _("<no .debug_str_offsets.dwo section>")
@@ -629,7 +645,7 @@ fetch_indexed_string (dwarf_vma idx, struct cu_tu_set
*this_set,
if (this_set != NULL)
index_offset += this_set->section_offsets [DW_SECT_STR_OFFSETS];
- if (index_offset > index_section->size)
+ if (index_offset >= index_section->size)
{
warn (_("DW_FORM_GNU_str_index offset too big: %s\n"),
dwarf_vmatoa ("x", index_offset));
@@ -642,14 +658,22 @@ fetch_indexed_string (dwarf_vma idx, struct cu_tu_set
*this_set,
str_offset = byte_get (index_section->start + index_offset, offset_size);
str_offset -= str_section->address;
- if (str_offset > str_section->size)
+ if (str_offset >= str_section->size)
{
warn (_("DW_FORM_GNU_str_index indirect offset too big: %s\n"),
dwarf_vmatoa ("x", str_offset));
return _("<indirect index offset is too big>");
}
- return (const char *) str_section->start + str_offset;
+ ret = (const char *) str_section->start + str_offset;
+ /* Unfortunately we cannot rely upon str_section ending with a NUL byte.
+ Since our caller is expecting to receive a well formed C string we test
+ for the lack of a terminating byte here. */
+ if (strnlen (ret, str_section->size - str_offset)
+ == str_section->size - str_offset)
+ ret = (const char *) _("<no NUL byte at end of section>");
+
+ return ret;
}
static const char *
--
2.13.0
1.1 src/patchsets/binutils/2.28/00_all_0008-CVE-2017-8393.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0008-CVE-2017-8393.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0008-CVE-2017-8393.patch?rev=1.1&content-type=text/plain
Index: 00_all_0008-CVE-2017-8393.patch
===================================================================
>From 86b4e5aeedbcf022e4d02810b48cb3e1a9d52d32 Mon Sep 17 00:00:00 2001
From: Matthias Maier <[email protected]>
Date: Tue, 6 Jun 2017 16:13:05 -0500
Subject: [PATCH 02/10] CVE-2017-8393
[1]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=bce964aa6c777d236fbd641f2bc7bb931cfe4bf3
[2] https://bugs.gentoo.org/show_bug.cgi?id=618516
---
bfd/elf-bfd.h | 8 ++++---
bfd/elf.c | 61 +++++++++++++++++++++++++++++++-----------------------
bfd/elf64-ppc.c | 1 +
bfd/elfxx-target.h | 2 +-
4 files changed, 42 insertions(+), 30 deletions(-)
diff --git a/bfd/elf-bfd.h b/bfd/elf-bfd.h
index 5de9ab6..366660a 100644
--- a/bfd/elf-bfd.h
+++ b/bfd/elf-bfd.h
@@ -1322,8 +1322,10 @@ struct elf_backend_data
bfd_size_type (*maybe_function_sym) (const asymbol *sym, asection *sec,
bfd_vma *code_off);
- /* Return the section which RELOC_SEC applies to. */
- asection *(*get_reloc_section) (asection *reloc_sec);
+ /* Given NAME, the name of a relocation section stripped of its
+ .rel/.rela prefix, return the section in ABFD to which the
+ relocations apply. */
+ asection *(*get_reloc_section) (bfd *abfd, const char *name);
/* Called to set the sh_flags, sh_link and sh_info fields of OSECTION which
has a type >= SHT_LOOS. Returns TRUE if the fields were initialised,
@@ -2392,7 +2394,7 @@ extern bfd_boolean _bfd_elf_is_function_type (unsigned
int);
extern bfd_size_type _bfd_elf_maybe_function_sym (const asymbol *, asection *,
bfd_vma *);
-extern asection *_bfd_elf_get_reloc_section (asection *);
+extern asection *_bfd_elf_plt_get_reloc_section (bfd *, const char *);
extern int bfd_elf_get_default_section_type (flagword);
diff --git a/bfd/elf.c b/bfd/elf.c
index 94726ba..4ddcb1f 100644
--- a/bfd/elf.c
+++ b/bfd/elf.c
@@ -3532,17 +3532,39 @@ bfd_elf_set_group_contents (bfd *abfd, asection *sec,
void *failedptrarg)
H_PUT_32 (abfd, sec->flags & SEC_LINK_ONCE ? GRP_COMDAT : 0, loc);
}
-/* Return the section which RELOC_SEC applies to. */
+/* Given NAME, the name of a relocation section stripped of its
+ .rel/.rela prefix, return the section in ABFD to which the
+ relocations apply. */
asection *
-_bfd_elf_get_reloc_section (asection *reloc_sec)
+_bfd_elf_plt_get_reloc_section (bfd *abfd, const char *name)
+{
+ /* If a target needs .got.plt section, relocations in rela.plt/rel.plt
+ section likely apply to .got.plt or .got section. */
+ if (get_elf_backend_data (abfd)->want_got_plt
+ && strcmp (name, ".plt") == 0)
+ {
+ asection *sec;
+
+ name = ".got.plt";
+ sec = bfd_get_section_by_name (abfd, name);
+ if (sec != NULL)
+ return sec;
+ name = ".got";
+ }
+
+ return bfd_get_section_by_name (abfd, name);
+}
+
+/* Return the section to which RELOC_SEC applies. */
+
+static asection *
+elf_get_reloc_section (asection *reloc_sec)
{
const char *name;
unsigned int type;
bfd *abfd;
-
- if (reloc_sec == NULL)
- return NULL;
+ const struct elf_backend_data *bed;
type = elf_section_data (reloc_sec)->this_hdr.sh_type;
if (type != SHT_REL && type != SHT_RELA)
@@ -3550,28 +3572,15 @@ _bfd_elf_get_reloc_section (asection *reloc_sec)
/* We look up the section the relocs apply to by name. */
name = reloc_sec->name;
- if (type == SHT_REL)
- name += 4;
- else
- name += 5;
+ if (strncmp (name, ".rel", 4) != 0)
+ return NULL;
+ name += 4;
+ if (type == SHT_RELA && *name++ != 'a')
+ return NULL;
- /* If a target needs .got.plt section, relocations in rela.plt/rel.plt
- section apply to .got.plt section. */
abfd = reloc_sec->owner;
- if (get_elf_backend_data (abfd)->want_got_plt
- && strcmp (name, ".plt") == 0)
- {
- /* .got.plt is a linker created input section. It may be mapped
- to some other output section. Try two likely sections. */
- name = ".got.plt";
- reloc_sec = bfd_get_section_by_name (abfd, name);
- if (reloc_sec != NULL)
- return reloc_sec;
- name = ".got";
- }
-
- reloc_sec = bfd_get_section_by_name (abfd, name);
- return reloc_sec;
+ bed = get_elf_backend_data (abfd);
+ return bed->get_reloc_section (abfd, name);
}
/* Assign all ELF section numbers. The dummy first section is handled here
@@ -3833,7 +3842,7 @@ assign_section_numbers (bfd *abfd, struct bfd_link_info
*link_info)
if (s != NULL)
d->this_hdr.sh_link = elf_section_data (s)->this_idx;
- s = get_elf_backend_data (abfd)->get_reloc_section (sec);
+ s = elf_get_reloc_section (sec);
if (s != NULL)
{
d->this_hdr.sh_info = elf_section_data (s)->this_idx;
diff --git a/bfd/elf64-ppc.c b/bfd/elf64-ppc.c
index e7d4792..81eccd8 100644
--- a/bfd/elf64-ppc.c
+++ b/bfd/elf64-ppc.c
@@ -121,6 +121,7 @@ static bfd_vma opd_entry_value
#define elf_backend_special_sections ppc64_elf_special_sections
#define elf_backend_merge_symbol_attribute ppc64_elf_merge_symbol_attribute
#define elf_backend_merge_symbol ppc64_elf_merge_symbol
+#define elf_backend_get_reloc_section bfd_get_section_by_name
/* The name of the dynamic interpreter. This is put in the .interp
section. */
diff --git a/bfd/elfxx-target.h b/bfd/elfxx-target.h
index d063fb7..ad8c5d9 100644
--- a/bfd/elfxx-target.h
+++ b/bfd/elfxx-target.h
@@ -706,7 +706,7 @@
#endif
#ifndef elf_backend_get_reloc_section
-#define elf_backend_get_reloc_section _bfd_elf_get_reloc_section
+#define elf_backend_get_reloc_section _bfd_elf_plt_get_reloc_section
#endif
#ifndef elf_backend_copy_special_section_fields
--
2.13.0
1.1 src/patchsets/binutils/2.28/00_all_0009-CVE-2017-8394.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0009-CVE-2017-8394.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0009-CVE-2017-8394.patch?rev=1.1&content-type=text/plain
Index: 00_all_0009-CVE-2017-8394.patch
===================================================================
>From d33b8e5e50b3eb33313e3c61039cf93d31e840b9 Mon Sep 17 00:00:00 2001
From: Matthias Maier <[email protected]>
Date: Tue, 6 Jun 2017 16:15:05 -0500
Subject: [PATCH 03/10] CVE-2017-8394
[1] https://bugs.gentoo.org/show_bug.cgi?id=618516
[2]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7eacd66b086cabb1daab20890d5481894d4f56b2
---
bfd/bfd-in2.h | 12 ++++++++++++
bfd/elf.c | 6 ++++--
bfd/section.c | 24 ++++++++++++------------
3 files changed, 28 insertions(+), 14 deletions(-)
diff --git a/bfd/bfd-in2.h b/bfd/bfd-in2.h
index 6288c3b..44e8711 100644
--- a/bfd/bfd-in2.h
+++ b/bfd/bfd-in2.h
@@ -1838,6 +1838,18 @@ extern asection _bfd_std_section[4];
{ NULL }, { NULL } \
}
+/* We use a macro to initialize the static asymbol structures because
+ traditional C does not permit us to initialize a union member while
+ gcc warns if we don't initialize it.
+ the_bfd, name, value, attr, section [, udata] */
+#ifdef __STDC__
+#define GLOBAL_SYM_INIT(NAME, SECTION) \
+ { 0, NAME, 0, BSF_SECTION_SYM, SECTION, { 0 }}
+#else
+#define GLOBAL_SYM_INIT(NAME, SECTION) \
+ { 0, NAME, 0, BSF_SECTION_SYM, SECTION }
+#endif
+
void bfd_section_list_clear (bfd *);
asection *bfd_get_section_by_name (bfd *abfd, const char *name);
diff --git a/bfd/elf.c b/bfd/elf.c
index 4ddcb1f..22c199a 100644
--- a/bfd/elf.c
+++ b/bfd/elf.c
@@ -11164,9 +11164,11 @@ _bfd_elf_get_synthetic_symtab (bfd *abfd,
/* It is only used by x86-64 so far.
??? This repeats *COM* id of zero. sec->id is supposed to be unique,
- but current usage would allow all of _bfd_std_section to be zero. t*/
+ but current usage would allow all of _bfd_std_section to be zero. */
+static const asymbol lcomm_sym
+ = GLOBAL_SYM_INIT ("LARGE_COMMON", &_bfd_elf_large_com_section);
asection _bfd_elf_large_com_section
- = BFD_FAKE_SECTION (_bfd_elf_large_com_section, NULL,
+ = BFD_FAKE_SECTION (_bfd_elf_large_com_section, &lcomm_sym,
"LARGE_COMMON", 0, SEC_IS_COMMON);
void
diff --git a/bfd/section.c b/bfd/section.c
index 4b3cf6a..28eee7f 100644
--- a/bfd/section.c
+++ b/bfd/section.c
@@ -738,20 +738,20 @@ CODE_FRAGMENT
. { NULL }, { NULL } \
. }
.
+.{* We use a macro to initialize the static asymbol structures because
+. traditional C does not permit us to initialize a union member while
+. gcc warns if we don't initialize it.
+. the_bfd, name, value, attr, section [, udata] *}
+.#ifdef __STDC__
+.#define GLOBAL_SYM_INIT(NAME, SECTION) \
+. { 0, NAME, 0, BSF_SECTION_SYM, SECTION, { 0 }}
+.#else
+.#define GLOBAL_SYM_INIT(NAME, SECTION) \
+. { 0, NAME, 0, BSF_SECTION_SYM, SECTION }
+.#endif
+.
*/
-/* We use a macro to initialize the static asymbol structures because
- traditional C does not permit us to initialize a union member while
- gcc warns if we don't initialize it. */
- /* the_bfd, name, value, attr, section [, udata] */
-#ifdef __STDC__
-#define GLOBAL_SYM_INIT(NAME, SECTION) \
- { 0, NAME, 0, BSF_SECTION_SYM, SECTION, { 0 }}
-#else
-#define GLOBAL_SYM_INIT(NAME, SECTION) \
- { 0, NAME, 0, BSF_SECTION_SYM, SECTION }
-#endif
-
/* These symbols are global, not specific to any BFD. Therefore, anything
that tries to change them is broken, and should be repaired. */
--
2.13.0
1.1 src/patchsets/binutils/2.28/00_all_0010-CVE-2017-8395.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0010-CVE-2017-8395.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0010-CVE-2017-8395.patch?rev=1.1&content-type=text/plain
Index: 00_all_0010-CVE-2017-8395.patch
===================================================================
>From a5e7c6c6fcc0aa2ad70a7b02c928f2b075140a5e Mon Sep 17 00:00:00 2001
From: Matthias Maier <[email protected]>
Date: Tue, 6 Jun 2017 16:16:39 -0500
Subject: [PATCH 04/10] CVE-2017-8395
[1] https://bugs.gentoo.org/show_bug.cgi?id=618516
[2]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=e63d123268f23a4cbc45ee55fb6dbc7d84729da3
---
bfd/compress.c | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
diff --git a/bfd/compress.c b/bfd/compress.c
index 1ed7d74..4a2d98a 100644
--- a/bfd/compress.c
+++ b/bfd/compress.c
@@ -542,7 +542,6 @@ bfd_init_section_compress_status (bfd *abfd, sec_ptr sec)
{
bfd_size_type uncompressed_size;
bfd_byte *uncompressed_buffer;
- bfd_boolean ret;
/* Error if not opened for read. */
if (abfd->direction != read_direction
@@ -558,18 +557,18 @@ bfd_init_section_compress_status (bfd *abfd, sec_ptr sec)
/* Read in the full section contents and compress it. */
uncompressed_size = sec->size;
uncompressed_buffer = (bfd_byte *) bfd_malloc (uncompressed_size);
+ /* PR 21431 */
+ if (uncompressed_buffer == NULL)
+ return FALSE;
+
if (!bfd_get_section_contents (abfd, sec, uncompressed_buffer,
0, uncompressed_size))
- ret = FALSE;
- else
- {
- uncompressed_size = bfd_compress_section_contents (abfd, sec,
- uncompressed_buffer,
- uncompressed_size);
- ret = uncompressed_size != 0;
- }
+ return FALSE;
- return ret;
+ uncompressed_size = bfd_compress_section_contents (abfd, sec,
+ uncompressed_buffer,
+ uncompressed_size);
+ return uncompressed_size != 0;
}
/*
--
2.13.0
1.1
src/patchsets/binutils/2.28/00_all_0011-CVE-2017-8396-CVE-2017-8397.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0011-CVE-2017-8396-CVE-2017-8397.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0011-CVE-2017-8396-CVE-2017-8397.patch?rev=1.1&content-type=text/plain
Index: 00_all_0011-CVE-2017-8396-CVE-2017-8397.patch
===================================================================
>From b3ef1a9331f8eaf178084393f1525ab9150c39d8 Mon Sep 17 00:00:00 2001
From: Matthias Maier <[email protected]>
Date: Tue, 6 Jun 2017 16:20:20 -0500
Subject: [PATCH 05/10] CVE-2017-8396, CVE-2017-8397
[1]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=04b31182bf3f8a1a76e995bdfaaaab4c009b9cb2
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=a941291cab71b9ac356e1c03968c177c03e602ab
[2] https://bugs.gentoo.org/show_bug.cgi?id=618516
---
bfd/reloc.c | 29 ++++++++++++++++++++---------
1 file changed, 20 insertions(+), 9 deletions(-)
diff --git a/bfd/reloc.c b/bfd/reloc.c
index 9021a52..80986b3 100644
--- a/bfd/reloc.c
+++ b/bfd/reloc.c
@@ -538,6 +538,22 @@ bfd_check_overflow (enum complain_overflow how,
return flag;
}
+/* HOWTO describes a relocation, at offset OCTET. Return whether the
+ relocation field is within SECTION of ABFD. */
+
+static bfd_boolean
+reloc_offset_in_range (reloc_howto_type *howto, bfd *abfd,
+ asection *section, bfd_size_type octet)
+{
+ bfd_size_type octet_end = bfd_get_section_limit_octets (abfd, section);
+ bfd_size_type reloc_size = bfd_get_reloc_size (howto);
+
+ /* The reloc field must be contained entirely within the section.
+ Allow zero length fields (marker relocs or NONE relocs where no
+ relocation will be performed) at the end of the section. */
+ return octet <= octet_end && octet + reloc_size <= octet_end;
+}
+
/*
FUNCTION
bfd_perform_relocation
@@ -619,12 +635,9 @@ bfd_perform_relocation (bfd *abfd,
if (howto == NULL)
return bfd_reloc_undefined;
- /* Is the address of the relocation really within the section?
- Include the size of the reloc in the test for out of range addresses.
- PR 17512: file: c146ab8b, 46dff27f, 38e53ebf. */
+ /* Is the address of the relocation really within the section? */
octets = reloc_entry->address * bfd_octets_per_byte (abfd);
- if (octets + bfd_get_reloc_size (howto)
- > bfd_get_section_limit_octets (abfd, input_section))
+ if (!reloc_offset_in_range (howto, abfd, input_section, octets))
return bfd_reloc_outofrange;
/* Work out which section the relocation is targeted at and the
@@ -1012,8 +1025,7 @@ bfd_install_relocation (bfd *abfd,
/* Is the address of the relocation really within the section? */
octets = reloc_entry->address * bfd_octets_per_byte (abfd);
- if (octets + bfd_get_reloc_size (howto)
- > bfd_get_section_limit_octets (abfd, input_section))
+ if (!reloc_offset_in_range (howto, abfd, input_section, octets))
return bfd_reloc_outofrange;
/* Work out which section the relocation is targeted at and the
@@ -1351,8 +1363,7 @@ _bfd_final_link_relocate (reloc_howto_type *howto,
bfd_size_type octets = address * bfd_octets_per_byte (input_bfd);
/* Sanity check the address. */
- if (octets + bfd_get_reloc_size (howto)
- > bfd_get_section_limit_octets (input_bfd, input_section))
+ if (!reloc_offset_in_range (howto, input_bfd, input_section, octets))
return bfd_reloc_outofrange;
/* This function assumes that we are dealing with a basic relocation
--
2.13.0
1.1 src/patchsets/binutils/2.28/00_all_0012-CVE-2017-8421.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0012-CVE-2017-8421.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0012-CVE-2017-8421.patch?rev=1.1&content-type=text/plain
Index: 00_all_0012-CVE-2017-8421.patch
===================================================================
>From a25bb8053a025a07741c4798720dc186800792da Mon Sep 17 00:00:00 2001
From: Matthias Maier <[email protected]>
Date: Tue, 6 Jun 2017 16:27:20 -0500
Subject: [PATCH 06/10] CVE-2017-8421
[1]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=39ff1b79f687b65f4144ddb379f22587003443fb
[2] https://bugs.gentoo.org/show_bug.cgi?id=618520
---
binutils/objdump.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/binutils/objdump.c b/binutils/objdump.c
index f61968b..0ec31f2 100644
--- a/binutils/objdump.c
+++ b/binutils/objdump.c
@@ -3311,6 +3311,14 @@ dump_relocs_in_section (bfd *abfd,
return;
}
+ if ((bfd_get_file_flags (abfd) & (BFD_IN_MEMORY | BFD_LINKER_CREATED)) == 0
+ && relsize > get_file_size (bfd_get_filename (abfd)))
+ {
+ printf (" (too many: 0x%x)\n", section->reloc_count);
+ bfd_set_error (bfd_error_file_truncated);
+ bfd_fatal (bfd_get_filename (abfd));
+ }
+
relpp = (arelent **) xmalloc (relsize);
relcount = bfd_canonicalize_reloc (abfd, section, relpp, syms);
--
2.13.0
1.1 src/patchsets/binutils/2.28/00_all_0013-CVE-2017-9038.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0013-CVE-2017-9038.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0013-CVE-2017-9038.patch?rev=1.1&content-type=text/plain
Index: 00_all_0013-CVE-2017-9038.patch
===================================================================
>From 02debfb464c87f7981db56e2d3e0372c8060c112 Mon Sep 17 00:00:00 2001
From: Matthias Maier <[email protected]>
Date: Tue, 6 Jun 2017 16:29:36 -0500
Subject: [PATCH 07/10] CVE-2017-9038
[1]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f32ba72991d2406b21ab17edc234a2f3fa7fb23d
[2] https://bugs.gentoo.org/show_bug.cgi?id=618826
---
binutils/readelf.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/binutils/readelf.c b/binutils/readelf.c
index 8dca490..76b0446 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -7965,9 +7965,9 @@ get_unwind_section_word (struct arm_unw_aux_info * aux,
return FALSE;
/* If the offset is invalid then fail. */
- if (word_offset > (sec->sh_size - 4)
- /* PR 18879 */
- || (sec->sh_size < 5 && word_offset >= sec->sh_size)
+ if (/* PR 21343 *//* PR 18879 */
+ sec->sh_size < 4
+ || word_offset > (sec->sh_size - 4)
|| ((bfd_signed_vma) word_offset) < 0)
return FALSE;
--
2.13.0
1.1 src/patchsets/binutils/2.28/00_all_0014-CVE-2017-9039.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0014-CVE-2017-9039.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0014-CVE-2017-9039.patch?rev=1.1&content-type=text/plain
Index: 00_all_0014-CVE-2017-9039.patch
===================================================================
>From cbd6b5d21e987c7799db6bc237ace666762e8ab9 Mon Sep 17 00:00:00 2001
From: Matthias Maier <[email protected]>
Date: Tue, 6 Jun 2017 16:33:56 -0500
Subject: [PATCH 08/10] CVE-2017-9039
[1]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=82156ab704b08b124d319c0decdbd48b3ca2dac5
[2] https://bugs.gentoo.org/show_bug.cgi?id=618826
---
binutils/readelf.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/binutils/readelf.c b/binutils/readelf.c
index 76b0446..659b777 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -4758,9 +4758,19 @@ get_program_headers (FILE * file)
if (program_headers != NULL)
return 1;
- phdrs = (Elf_Internal_Phdr *) cmalloc (elf_header.e_phnum,
- sizeof (Elf_Internal_Phdr));
+ /* Be kind to memory checkers by looking for
+ e_phnum values which we know must be invalid. */
+ if (elf_header.e_phnum
+ * (is_32bit_elf ? sizeof (Elf32_External_Phdr) : sizeof
(Elf64_External_Phdr))
+ >= current_file_size)
+ {
+ error (_("Too many program headers - %#x - the file is not that big\n"),
+ elf_header.e_phnum);
+ return FALSE;
+ }
+ phdrs = (Elf_Internal_Phdr *) cmalloc (elf_header.e_phnum,
+ sizeof (Elf_Internal_Phdr));
if (phdrs == NULL)
{
error (_("Out of memory reading %u program headers\n"),
--
2.13.0
1.1
src/patchsets/binutils/2.28/00_all_0015-CVE-2017-9040-CVE-2017-9042.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0015-CVE-2017-9040-CVE-2017-9042.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0015-CVE-2017-9040-CVE-2017-9042.patch?rev=1.1&content-type=text/plain
Index: 00_all_0015-CVE-2017-9040-CVE-2017-9042.patch
===================================================================
>From 5eeab6e574d9712efe1f2ddaf48b6dddba69dc52 Mon Sep 17 00:00:00 2001
From: Matthias Maier <[email protected]>
Date: Tue, 6 Jun 2017 16:37:58 -0500
Subject: [PATCH 09/10] CVE-2017-9040, CVE-2017-9042
[1]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7296a62a2a237f6b1ad8db8c38b090e9f592c8cf
[2] https://bugs.gentoo.org/show_bug.cgi?id=618826
---
binutils/readelf.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/binutils/readelf.c b/binutils/readelf.c
index 659b777..74e4c3a 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -9299,6 +9299,12 @@ process_dynamic_section (FILE * file)
processing that. This is overkill, I know, but it
should work. */
section.sh_offset = offset_from_vma (file, entry->d_un.d_val, 0);
+ if ((bfd_size_type) section.sh_offset > current_file_size)
+ {
+ /* See PR 21379 for a reproducer. */
+ error (_("Invalid DT_SYMTAB entry: %lx"), (long)
section.sh_offset);
+ return FALSE;
+ }
if (archive_file_offset != 0)
section.sh_size = archive_file_size - section.sh_offset;
@@ -15081,6 +15087,15 @@ process_mips_specific (FILE * file)
return 0;
}
+ /* PR 21345 - print a slightly more helpful error message
+ if we are sure that the cmalloc will fail. */
+ if (conflictsno * sizeof (* iconf) > current_file_size)
+ {
+ error (_("Overlarge number of conflicts detected: %lx\n"),
+ (long) conflictsno);
+ return FALSE;
+ }
+
iconf = (Elf32_Conflict *) cmalloc (conflictsno, sizeof (* iconf));
if (iconf == NULL)
{
--
2.13.0
1.1 src/patchsets/binutils/2.28/00_all_0016-CVE-2017-9041.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0016-CVE-2017-9041.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0016-CVE-2017-9041.patch?rev=1.1&content-type=text/plain
Index: 00_all_0016-CVE-2017-9041.patch
===================================================================
>From 936856858aebc77e8d480f25c69e486057b05dfe Mon Sep 17 00:00:00 2001
From: Matthias Maier <[email protected]>
Date: Tue, 6 Jun 2017 16:41:59 -0500
Subject: [PATCH 10/10] CVE-2017-9041
[1]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=patch;h=75ec1fdbb797a389e4fe4aaf2e15358a070dcc19
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=patch;h=c4ab9505b53cdc899506ed421fddb7e1f8faf7a3
[2] https://bugs.gentoo.org/show_bug.cgi?id=618826
---
binutils/readelf.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/binutils/readelf.c b/binutils/readelf.c
index 74e4c3a..5507663 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -15211,7 +15211,14 @@ process_mips_specific (FILE * file)
printf (_(" Lazy resolver\n"));
if (ent == (bfd_vma) -1)
goto got_print_fail;
+
+ /* Check for the MSB of GOT[1] being set, denoting a GNU object.
+ This entry will be used by some runtime loaders, to store the
+ module pointer. Otherwise this is an ordinary local entry.
+ PR 21344: Check for the entry being fully available before
+ fetching it. */
if (data
+ && data + ent - pltgot + addr_size <= data_end
&& (byte_get (data + ent - pltgot, addr_size)
>> (addr_size * 8 - 1)) != 0)
{
--
2.13.0
1.1 src/patchsets/binutils/2.28/00_all_0017-CVE-2017-7614.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0017-CVE-2017-7614.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0017-CVE-2017-7614.patch?rev=1.1&content-type=text/plain
Index: 00_all_0017-CVE-2017-7614.patch
===================================================================
>From 398dc44e4596294a24f74771db0ea6006034b501 Mon Sep 17 00:00:00 2001
From: Matthias Maier <[email protected]>
Date: Tue, 6 Jun 2017 17:12:24 -0500
Subject: [PATCH] CVE-2017-7614
[1]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ad32986fdf9da1c8748e47b8b45100398223dba8
[2] https://bugs.gentoo.org/show_bug.cgi?id=618006
---
bfd/elflink.c | 35 +++++++++++++++++++++--------------
1 file changed, 21 insertions(+), 14 deletions(-)
diff --git a/bfd/elflink.c b/bfd/elflink.c
index 69b66f2..96f74be 100644
--- a/bfd/elflink.c
+++ b/bfd/elflink.c
@@ -119,15 +119,18 @@ _bfd_elf_define_linkage_sym (bfd *abfd,
defined in shared libraries can't be overridden, because we
lose the link to the bfd which is via the symbol section. */
h->root.type = bfd_link_hash_new;
+ bh = &h->root;
}
+ else
+ bh = NULL;
- bh = &h->root;
bed = get_elf_backend_data (abfd);
if (!_bfd_generic_link_add_one_symbol (info, abfd, name, BSF_GLOBAL,
sec, 0, NULL, FALSE, bed->collect,
&bh))
return NULL;
h = (struct elf_link_hash_entry *) bh;
+ BFD_ASSERT (h != NULL);
h->def_regular = 1;
h->non_elf = 0;
h->root.linker_def = 1;
@@ -11973,24 +11976,28 @@ bfd_elf_final_link (bfd *abfd, struct bfd_link_info
*info)
{
/* Finish up and write out the symbol string table (.strtab)
section. */
- Elf_Internal_Shdr *symstrtab_hdr;
+ Elf_Internal_Shdr *symstrtab_hdr = NULL;
file_ptr off = symtab_hdr->sh_offset + symtab_hdr->sh_size;
- symtab_shndx_hdr = & elf_symtab_shndx_list (abfd)->hdr;
- if (symtab_shndx_hdr != NULL && symtab_shndx_hdr->sh_name != 0)
+ if (elf_symtab_shndx_list (abfd))
{
- symtab_shndx_hdr->sh_type = SHT_SYMTAB_SHNDX;
- symtab_shndx_hdr->sh_entsize = sizeof (Elf_External_Sym_Shndx);
- symtab_shndx_hdr->sh_addralign = sizeof (Elf_External_Sym_Shndx);
- amt = bfd_get_symcount (abfd) * sizeof (Elf_External_Sym_Shndx);
- symtab_shndx_hdr->sh_size = amt;
+ symtab_shndx_hdr = & elf_symtab_shndx_list (abfd)->hdr;
- off = _bfd_elf_assign_file_position_for_section (symtab_shndx_hdr,
- off, TRUE);
+ if (symtab_shndx_hdr != NULL && symtab_shndx_hdr->sh_name != 0)
+ {
+ symtab_shndx_hdr->sh_type = SHT_SYMTAB_SHNDX;
+ symtab_shndx_hdr->sh_entsize = sizeof (Elf_External_Sym_Shndx);
+ symtab_shndx_hdr->sh_addralign = sizeof (Elf_External_Sym_Shndx);
+ amt = bfd_get_symcount (abfd) * sizeof (Elf_External_Sym_Shndx);
+ symtab_shndx_hdr->sh_size = amt;
- if (bfd_seek (abfd, symtab_shndx_hdr->sh_offset, SEEK_SET) != 0
- || (bfd_bwrite (flinfo.symshndxbuf, amt, abfd) != amt))
- return FALSE;
+ off = _bfd_elf_assign_file_position_for_section (symtab_shndx_hdr,
+ off, TRUE);
+
+ if (bfd_seek (abfd, symtab_shndx_hdr->sh_offset, SEEK_SET) != 0
+ || (bfd_bwrite (flinfo.symshndxbuf, amt, abfd) != amt))
+ return FALSE;
+ }
}
symstrtab_hdr = &elf_tdata (abfd)->strtab_hdr;
--
2.13.0
