On Tue Mar 17, 2026 at 5:12 AM CET, Deepak Rathore via lists.openembedded.org
wrote:
> From: Deepak Rathore <[email protected]>
>
> Pick the patch [1] as mentioned in [2].
>
> [1]
> https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=598704a00cbac5e85c2bedd363357b5bf6fcee33
> [2] https://nvd.nist.gov/vuln/detail/CVE-2025-69648
>
> Signed-off-by: Deepak Rathore <[email protected]>
>
> diff --git a/meta/recipes-devtools/binutils/binutils-2.45.inc
> b/meta/recipes-devtools/binutils/binutils-2.45.inc
> index 16a63cabc5..b6d7b3d60f 100644
> --- a/meta/recipes-devtools/binutils/binutils-2.45.inc
> +++ b/meta/recipes-devtools/binutils/binutils-2.45.inc
> @@ -46,4 +46,5 @@ SRC_URI = "\
> file://0018-CVE-2025-11494.patch \
> file://0019-CVE-2025-11839.patch \
> file://0020-CVE-2025-11840.patch \
> + file://CVE-2025-69648.patch \
> "
> diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-69648.patch
> b/meta/recipes-devtools/binutils/binutils/CVE-2025-69648.patch
> new file mode 100644
> index 0000000000..a247bc0fe7
> --- /dev/null
> +++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-69648.patch
> @@ -0,0 +1,188 @@
> +From da5460f518952684a8c774d9b202a395676ff85f Mon Sep 17 00:00:00 2001
> +From: Alan Modra <[email protected]>
> +Date: Sat, 22 Nov 2025 09:22:10 +1030
> +Subject: [PATCH] PR 33638, debug_rnglists output
> +
> +The fuzzed testcase in this PR continuously outputs an error about
> +the debug_rnglists header. Fixed by taking notice of the error and
> +stopping output. The patch also limits the length in all cases, not
> +just when a relocation is present, and limits the offset entry count
> +read from the header. I removed the warning and the test for relocs
> +because the code can't work reliably with unresolved relocs in the
> +length field.
> +
> + PR 33638
> + * dwarf.c (display_debug_rnglists_list): Return bool. Rename
> + "inital_length" to plain "length". Verify length is large
> + enough to read header. Limit length to rest of section.
> + Similarly limit offset_entry_count.
> + (display_debug_ranges): Check display_debug_rnglists_unit_header
> + return status. Stop output on error.
> +
> +CVE: CVE-2025-69648
> +Upstream-Status: Backport
> [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=598704a00cbac5e85c2bedd363357b5bf6fcee33]
> +
> +(cherry picked from commit 598704a00cbac5e85c2bedd363357b5bf6fcee33)
> +Signed-off-by: Deepak Rathore <[email protected]>
> +---
> + binutils/dwarf.c | 67 ++++++++++++++++++++++++------------------------
> + 1 file changed, 34 insertions(+), 33 deletions(-)
> +
> +diff --git a/binutils/dwarf.c b/binutils/dwarf.c
> +index d9f514180de..0d88ea94619 100644
> +--- a/binutils/dwarf.c
> ++++ b/binutils/dwarf.c
> +@@ -8292,7 +8292,7 @@ display_debug_rnglists_list (unsigned char * start,
> + return start;
> + }
> +
> +-static int
> ++static bool
> + display_debug_rnglists_unit_header (struct dwarf_section * section,
> + uint64_t * unit_offset,
Hello,
This patch and other in the whole series has a weird format. The context
lines starts with tabs and not a single space as usual. While it seems
like it passes tests, I'm afraid it will break something down the line
and I'd rather not take this like this.
Can you please check?
Thanks!
> + unsigned char * poffset_size)
> +@@ -8300,7 +8300,8 @@ display_debug_rnglists_unit_header (struct
> dwarf_section * section,
> + uint64_t start_offset = *unit_offset;
> + unsigned char * p = section->start + start_offset;
> + unsigned char * finish = section->start + section->size;
> +- uint64_t initial_length;
> ++ unsigned char * hdr;
> ++ uint64_t length;
> + unsigned char segment_selector_size;
> + unsigned int offset_entry_count;
> + unsigned int i;
> +@@ -8309,66 +8310,59 @@ display_debug_rnglists_unit_header (struct
> dwarf_section * section,
> + unsigned char offset_size;
> +
> + /* Get and check the length of the block. */
> +- SAFE_BYTE_GET_AND_INC (initial_length, p, 4, finish);
> ++ SAFE_BYTE_GET_AND_INC (length, p, 4, finish);
> +
> +- if (initial_length == 0xffffffff)
> ++ if (length == 0xffffffff)
> + {
> + /* This section is 64-bit DWARF 3. */
> +- SAFE_BYTE_GET_AND_INC (initial_length, p, 8, finish);
> ++ SAFE_BYTE_GET_AND_INC (length, p, 8, finish);
> + *poffset_size = offset_size = 8;
> + }
> + else
> + *poffset_size = offset_size = 4;
> +
> +- if (initial_length > (size_t) (finish - p))
> +- {
> +- /* If the length field has a relocation against it, then we should
> +- not complain if it is inaccurate (and probably negative).
> +- It is copied from .debug_line handling code. */
> +- if (reloc_at (section, (p - section->start) - offset_size))
> +- initial_length = finish - p;
> +- else
> +- {
> +- warn (_("The length field (%#" PRIx64
> +- ") in the debug_rnglists header is wrong"
> +- " - the section is too small\n"),
> +- initial_length);
> +- return 0;
> +- }
> +- }
> +-
> +- /* Report the next unit offset to the caller. */
> +- *unit_offset = (p - section->start) + initial_length;
> ++ if (length < 8)
> ++ return false;
> +
> + /* Get the other fields in the header. */
> ++ hdr = p;
> + SAFE_BYTE_GET_AND_INC (version, p, 2, finish);
> + SAFE_BYTE_GET_AND_INC (address_size, p, 1, finish);
> + SAFE_BYTE_GET_AND_INC (segment_selector_size, p, 1, finish);
> + SAFE_BYTE_GET_AND_INC (offset_entry_count, p, 4, finish);
> +
> + printf (_(" Table at Offset: %#" PRIx64 ":\n"), start_offset);
> +- printf (_(" Length: %#" PRIx64 "\n"), initial_length);
> ++ printf (_(" Length: %#" PRIx64 "\n"), length);
> + printf (_(" DWARF version: %u\n"), version);
> + printf (_(" Address size: %u\n"), address_size);
> + printf (_(" Segment size: %u\n"), segment_selector_size);
> + printf (_(" Offset entries: %u\n"), offset_entry_count);
> +
> ++ if (length > (size_t) (finish - hdr))
> ++ length = finish - hdr;
> ++
> ++ /* Report the next unit offset to the caller. */
> ++ *unit_offset = (hdr - section->start) + length;
> ++
> + /* Check the fields. */
> + if (segment_selector_size != 0)
> + {
> + warn (_("The %s section contains "
> + "unsupported segment selector size: %d.\n"),
> + section->name, segment_selector_size);
> +- return 0;
> ++ return false;
> + }
> +
> + if (version < 5)
> + {
> + warn (_("Only DWARF version 5+ debug_rnglists info "
> + "is currently supported.\n"));
> +- return 0;
> ++ return false;
> + }
> +
> ++ uint64_t max_off_count = (length - 8) / offset_size;
> ++ if (offset_entry_count > max_off_count)
> ++ offset_entry_count = max_off_count;
> + if (offset_entry_count != 0)
> + {
> + printf (_("\n Offsets starting at %#tx:\n"), p - section->start);
> +@@ -8382,7 +8376,7 @@ display_debug_rnglists_unit_header (struct
> dwarf_section * section,
> + }
> + }
> +
> +- return 1;
> ++ return true;
> + }
> +
> + static bool
> +@@ -8414,6 +8408,7 @@ display_debug_ranges (struct dwarf_section *section,
> + uint64_t last_offset = 0;
> + uint64_t next_rnglists_cu_offset = 0;
> + unsigned char offset_size;
> ++ bool ok_header = true;
> +
> + if (bytes == 0)
> + {
> +@@ -8503,8 +8498,12 @@ display_debug_ranges (struct dwarf_section *section,
> + /* If we've moved on to the next compile unit in the rnglists section
> - dump the unit header(s). */
> + if (is_rnglists && next_rnglists_cu_offset < offset)
> + {
> +- while (next_rnglists_cu_offset < offset)
> +- display_debug_rnglists_unit_header (section,
> &next_rnglists_cu_offset, &offset_size);
> ++ while (ok_header && next_rnglists_cu_offset < offset)
> ++ ok_header = display_debug_rnglists_unit_header (section,
> ++
> &next_rnglists_cu_offset,
> ++ &offset_size);
> ++ if (!ok_header)
> ++ break;
> + printf (_(" Offset Begin End\n"));
> + }
> +
> +@@ -8558,10 +8557,12 @@ display_debug_ranges (struct dwarf_section *section,
> + }
> +
> + /* Display trailing empty (or unreferenced) compile units, if any. */
> +- if (is_rnglists)
> ++ if (is_rnglists && ok_header)
> + while (next_rnglists_cu_offset < section->size)
> +- display_debug_rnglists_unit_header (section,
> &next_rnglists_cu_offset, &offset_size);
> +-
> ++ if (!display_debug_rnglists_unit_header (section,
> ++ &next_rnglists_cu_offset,
> ++ &offset_size))
> ++ break;
> + putchar ('\n');
> +
> + free (range_entries);
> +--
> +2.35.6
--
Yoann Congal
Smile ECS
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#233559):
https://lists.openembedded.org/g/openembedded-core/message/233559
Mute This Topic: https://lists.openembedded.org/mt/118359424/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
