tamiko 17/06/07 14:44:23
Modified: README.history
Added: 00_all_0018-CVE-2017-6965.patch
00_all_0019-CVE-2017-6966.patch
00_all_0020-CVE-2017-6969.patch
Log:
binutils-2.28: Update to patchset 1.2
Revision Changes Path
1.3 src/patchsets/binutils/2.28/README.history
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/README.history?rev=1.3&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/README.history?rev=1.3&content-type=text/plain
diff :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/README.history?r1=1.2&r2=1.3
Index: README.history
===================================================================
RCS file: /var/cvsroot/gentoo/src/patchsets/binutils/2.28/README.history,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- README.history 6 Jun 2017 22:17:49 -0000 1.2
+++ README.history 7 Jun 2017 14:44:23 -0000 1.3
@@ -1,3 +1,8 @@
+1.2 07 Jun 2017
+ + 00_all_0018-CVE-2017-6965.patch
+ + 00_all_0019-CVE-2017-6966.patch
+ + 00_all_0020-CVE-2017-6969.patch
+
1.1 06 Jun 2017
+ 00_all_0007-CVE-2017-8398.patch
+ 00_all_0008-CVE-2017-8393.patch
1.1 src/patchsets/binutils/2.28/00_all_0018-CVE-2017-6965.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0018-CVE-2017-6965.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0018-CVE-2017-6965.patch?rev=1.1&content-type=text/plain
Index: 00_all_0018-CVE-2017-6965.patch
===================================================================
>From 00e45d8e07536e7eee850f00a6101011e7088171 Mon Sep 17 00:00:00 2001
From: Matthias Maier <[email protected]>
Date: Wed, 7 Jun 2017 09:29:37 -0500
Subject: [PATCH 1/3] CVE-2017-6965
[PATCH] Fix readelf writing to illegal addresses whilst processing corrupt
input files containing symbol-difference relocations.
[1]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=03f7786e2f440b9892b1c34a58fb26222ce1b493
[2] https://bugs.gentoo.org/show_bug.cgi?id=621130
---
binutils/readelf.c | 30 +++++++++++++++++++++++++-----
1 file changed, 25 insertions(+), 5 deletions(-)
diff --git a/binutils/readelf.c b/binutils/readelf.c
index 5507663..7a908a1 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -11600,6 +11600,7 @@ process_syminfo (FILE * file ATTRIBUTE_UNUSED)
static bfd_boolean
target_specific_reloc_handling (Elf_Internal_Rela * reloc,
unsigned char * start,
+ unsigned char * end,
Elf_Internal_Sym * symtab)
{
unsigned int reloc_type = get_reloc_type (reloc->r_info);
@@ -11640,13 +11641,19 @@ target_specific_reloc_handling (Elf_Internal_Rela *
reloc,
handle_sym_diff:
if (saved_sym != NULL)
{
+ int reloc_size = reloc_type == 1 ? 4 : 2;
bfd_vma value;
value = reloc->r_addend
+ (symtab[get_reloc_symindex (reloc->r_info)].st_value
- saved_sym->st_value);
- byte_put (start + reloc->r_offset, value, reloc_type == 1 ? 4 :
2);
+ if (start + reloc->r_offset + reloc_size >= end)
+ /* PR 21137 */
+ error (_("MSP430 sym diff reloc writes past end of section
(%p vs %p)\n"),
+ start + reloc->r_offset + reloc_size, end);
+ else
+ byte_put (start + reloc->r_offset, value, reloc_size);
saved_sym = NULL;
return TRUE;
@@ -11677,13 +11684,18 @@ target_specific_reloc_handling (Elf_Internal_Rela *
reloc,
case 2: /* R_MN10300_16 */
if (saved_sym != NULL)
{
+ int reloc_size = reloc_type == 1 ? 4 : 2;
bfd_vma value;
value = reloc->r_addend
+ (symtab[get_reloc_symindex (reloc->r_info)].st_value
- saved_sym->st_value);
- byte_put (start + reloc->r_offset, value, reloc_type == 1 ? 4 :
2);
+ if (start + reloc->r_offset + reloc_size >= end)
+ error (_("MN10300 sym diff reloc writes past end of section
(%p vs %p)\n"),
+ start + reloc->r_offset + reloc_size, end);
+ else
+ byte_put (start + reloc->r_offset, value, reloc_size);
saved_sym = NULL;
return TRUE;
@@ -11718,12 +11730,20 @@ target_specific_reloc_handling (Elf_Internal_Rela *
reloc,
break;
case 0x41: /* R_RL78_ABS32. */
- byte_put (start + reloc->r_offset, value, 4);
+ if (start + reloc->r_offset + 4 >= end)
+ error (_("RL78 sym diff reloc writes past end of section (%p vs
%p)\n"),
+ start + reloc->r_offset + 2, end);
+ else
+ byte_put (start + reloc->r_offset, value, 4);
value = 0;
return TRUE;
case 0x43: /* R_RL78_ABS16. */
- byte_put (start + reloc->r_offset, value, 2);
+ if (start + reloc->r_offset + 2 >= end)
+ error (_("RL78 sym diff reloc writes past end of section (%p vs
%p)\n"),
+ start + reloc->r_offset + 2, end);
+ else
+ byte_put (start + reloc->r_offset, value, 2);
value = 0;
return TRUE;
@@ -12340,7 +12360,7 @@ apply_relocations (void * file,
reloc_type = get_reloc_type (rp->r_info);
- if (target_specific_reloc_handling (rp, start, symtab))
+ if (target_specific_reloc_handling (rp, start, end, symtab))
continue;
else if (is_none_reloc (reloc_type))
continue;
--
2.13.0
1.1 src/patchsets/binutils/2.28/00_all_0019-CVE-2017-6966.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0019-CVE-2017-6966.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0019-CVE-2017-6966.patch?rev=1.1&content-type=text/plain
Index: 00_all_0019-CVE-2017-6966.patch
===================================================================
>From f25ff3ce9735df03fcbe7ecc1897cf8e0de4b6ae Mon Sep 17 00:00:00 2001
From: Matthias Maier <[email protected]>
Date: Wed, 7 Jun 2017 09:31:53 -0500
Subject: [PATCH 2/3] CVE-2017-6966
[PATCH] Fix read-after-free error in readelf when processing multiple,
relocated sections in an MSP430 binary.
[1]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f84ce13b6708801ca1d6289b7c4003e2f5a6d7f9
[2] https://bugs.gentoo.org/show_bug.cgi?id=621130
---
binutils/readelf.c | 109 +++++++++++++++++++++++++++++++++++++++++------------
1 file changed, 84 insertions(+), 25 deletions(-)
diff --git a/binutils/readelf.c b/binutils/readelf.c
index 7a908a1..fd23b6b 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -11595,15 +11595,27 @@ process_syminfo (FILE * file ATTRIBUTE_UNUSED)
/* Check to see if the given reloc needs to be handled in a target specific
manner. If so then process the reloc and return TRUE otherwise return
- FALSE. */
+ FALSE.
+
+ If called with reloc == NULL, then this is a signal that reloc processing
+ for the current section has finished, and any saved state should be
+ discarded. */
static bfd_boolean
target_specific_reloc_handling (Elf_Internal_Rela * reloc,
unsigned char * start,
unsigned char * end,
- Elf_Internal_Sym * symtab)
+ Elf_Internal_Sym * symtab,
+ unsigned long num_syms)
{
- unsigned int reloc_type = get_reloc_type (reloc->r_info);
+ unsigned int reloc_type = 0;
+ unsigned long sym_index = 0;
+
+ if (reloc)
+ {
+ reloc_type = get_reloc_type (reloc->r_info);
+ sym_index = get_reloc_symindex (reloc->r_info);
+ }
switch (elf_header.e_machine)
{
@@ -11612,6 +11624,12 @@ target_specific_reloc_handling (Elf_Internal_Rela *
reloc,
{
static Elf_Internal_Sym * saved_sym = NULL;
+ if (reloc == NULL)
+ {
+ saved_sym = NULL;
+ return TRUE;
+ }
+
switch (reloc_type)
{
case 10: /* R_MSP430_SYM_DIFF */
@@ -11619,7 +11637,12 @@ target_specific_reloc_handling (Elf_Internal_Rela *
reloc,
break;
/* Fall through. */
case 21: /* R_MSP430X_SYM_DIFF */
- saved_sym = symtab + get_reloc_symindex (reloc->r_info);
+ /* PR 21139. */
+ if (sym_index >= num_syms)
+ error (_("MSP430 SYM_DIFF reloc contains invalid symbol index
%lu\n"),
+ sym_index);
+ else
+ saved_sym = symtab + sym_index;
return TRUE;
case 1: /* R_MSP430_32 or R_MSP430_ABS32 */
@@ -11644,16 +11667,21 @@ target_specific_reloc_handling (Elf_Internal_Rela *
reloc,
int reloc_size = reloc_type == 1 ? 4 : 2;
bfd_vma value;
- value = reloc->r_addend
- + (symtab[get_reloc_symindex (reloc->r_info)].st_value
- - saved_sym->st_value);
-
- if (start + reloc->r_offset + reloc_size >= end)
- /* PR 21137 */
- error (_("MSP430 sym diff reloc writes past end of section
(%p vs %p)\n"),
- start + reloc->r_offset + reloc_size, end);
+ if (sym_index >= num_syms)
+ error (_("MSP430 reloc contains invalid symbol index %lu\n"),
+ sym_index);
else
- byte_put (start + reloc->r_offset, value, reloc_size);
+ {
+ value = reloc->r_addend + (symtab[sym_index].st_value
+ - saved_sym->st_value);
+
+ if (start + reloc->r_offset + reloc_size >= end)
+ /* PR 21137 */
+ error (_("MSP430 sym diff reloc writes past end of
section (%p vs %p)\n"),
+ start + reloc->r_offset + reloc_size, end);
+ else
+ byte_put (start + reloc->r_offset, value, reloc_size);
+ }
saved_sym = NULL;
return TRUE;
@@ -11673,13 +11701,24 @@ target_specific_reloc_handling (Elf_Internal_Rela *
reloc,
{
static Elf_Internal_Sym * saved_sym = NULL;
+ if (reloc == NULL)
+ {
+ saved_sym = NULL;
+ return TRUE;
+ }
+
switch (reloc_type)
{
case 34: /* R_MN10300_ALIGN */
return TRUE;
case 33: /* R_MN10300_SYM_DIFF */
- saved_sym = symtab + get_reloc_symindex (reloc->r_info);
+ if (sym_index >= num_syms)
+ error (_("MN10300_SYM_DIFF reloc contains invalid symbol index
%lu\n"),
+ sym_index);
+ else
+ saved_sym = symtab + sym_index;
return TRUE;
+
case 1: /* R_MN10300_32 */
case 2: /* R_MN10300_16 */
if (saved_sym != NULL)
@@ -11687,15 +11726,20 @@ target_specific_reloc_handling (Elf_Internal_Rela *
reloc,
int reloc_size = reloc_type == 1 ? 4 : 2;
bfd_vma value;
- value = reloc->r_addend
- + (symtab[get_reloc_symindex (reloc->r_info)].st_value
- - saved_sym->st_value);
-
- if (start + reloc->r_offset + reloc_size >= end)
- error (_("MN10300 sym diff reloc writes past end of section
(%p vs %p)\n"),
- start + reloc->r_offset + reloc_size, end);
+ if (sym_index >= num_syms)
+ error (_("MN10300 reloc contains invalid symbol index %lu\n"),
+ sym_index);
else
- byte_put (start + reloc->r_offset, value, reloc_size);
+ {
+ value = reloc->r_addend + (symtab[sym_index].st_value
+ - saved_sym->st_value);
+
+ if (start + reloc->r_offset + reloc_size >= end)
+ error (_("MN10300 sym diff reloc writes past end of
section (%p vs %p)\n"),
+ start + reloc->r_offset + reloc_size, end);
+ else
+ byte_put (start + reloc->r_offset, value, reloc_size);
+ }
saved_sym = NULL;
return TRUE;
@@ -11715,12 +11759,24 @@ target_specific_reloc_handling (Elf_Internal_Rela *
reloc,
static bfd_vma saved_sym2 = 0;
static bfd_vma value;
+ if (reloc == NULL)
+ {
+ saved_sym1 = saved_sym2 = 0;
+ return TRUE;
+ }
+
switch (reloc_type)
{
case 0x80: /* R_RL78_SYM. */
saved_sym1 = saved_sym2;
- saved_sym2 = symtab[get_reloc_symindex (reloc->r_info)].st_value;
- saved_sym2 += reloc->r_addend;
+ if (sym_index >= num_syms)
+ error (_("RL78_SYM reloc contains invalid symbol index %lu\n"),
+ sym_index);
+ else
+ {
+ saved_sym2 = symtab[sym_index].st_value;
+ saved_sym2 += reloc->r_addend;
+ }
return TRUE;
case 0x83: /* R_RL78_OPsub. */
@@ -12360,7 +12416,7 @@ apply_relocations (void * file,
reloc_type = get_reloc_type (rp->r_info);
- if (target_specific_reloc_handling (rp, start, end, symtab))
+ if (target_specific_reloc_handling (rp, start, end, symtab, num_syms))
continue;
else if (is_none_reloc (reloc_type))
continue;
@@ -12456,6 +12512,9 @@ apply_relocations (void * file,
}
free (symtab);
+ /* Let the target specific reloc processing code know that
+ we have finished with these relocs. */
+ target_specific_reloc_handling (NULL, NULL, NULL, NULL, 0);
if (relocs_return)
{
--
2.13.0
1.1 src/patchsets/binutils/2.28/00_all_0020-CVE-2017-6969.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0020-CVE-2017-6969.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/binutils/2.28/00_all_0020-CVE-2017-6969.patch?rev=1.1&content-type=text/plain
Index: 00_all_0020-CVE-2017-6969.patch
===================================================================
>From bb8c412a9450141286bf4eef04b14fe47bbc364f Mon Sep 17 00:00:00 2001
From: Matthias Maier <[email protected]>
Date: Wed, 7 Jun 2017 09:35:35 -0500
Subject: [PATCH 3/3] CVE-2017-6969
[PATCH] Fix illegal memory accesses in readelf when parsing a corrupt binary.
[PATCH] Fix another memory access error in readelf when parsing a corrupt
binary.
[1]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b814a36d3440de95f2ac6eaa4fc7935c322ea456
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=43a444f9c5bfd44b4304eafd78338e21d54bea14
[2] https://bugs.gentoo.org/show_bug.cgi?id=621130
---
binutils/dwarf.c | 34 ++++++++++++++++++++--------------
binutils/readelf.c | 10 ++++++++--
2 files changed, 28 insertions(+), 16 deletions(-)
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 05efa6e..3312bc5 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -76,7 +76,6 @@ int dwarf_check = 0;
as a zero-terminated list of section indexes comprising one set of debug
sections from a .dwo file. */
-static int cu_tu_indexes_read = 0;
static unsigned int *shndx_pool = NULL;
static unsigned int shndx_pool_size = 0;
static unsigned int shndx_pool_used = 0;
@@ -99,7 +98,7 @@ static int tu_count = 0;
static struct cu_tu_set *cu_sets = NULL;
static struct cu_tu_set *tu_sets = NULL;
-static void load_cu_tu_indexes (void *file);
+static bfd_boolean load_cu_tu_indexes (void *);
/* Values for do_debug_lines. */
#define FLAG_DEBUG_LINES_RAW 1
@@ -2739,7 +2738,7 @@ load_debug_info (void * file)
return num_debug_info_entries;
/* If this is a DWARF package file, load the CU and TU indexes. */
- load_cu_tu_indexes (file);
+ (void) load_cu_tu_indexes (file);
if (load_debug_section (info, file)
&& process_debug_info (&debug_displays [info].section, file, abbrev, 1,
0))
@@ -7402,21 +7401,27 @@ process_cu_tu_index (struct dwarf_section *section, int
do_display)
section sets that we can use to associate a .debug_info.dwo section
with its associated .debug_abbrev.dwo section in a .dwp file. */
-static void
+static bfd_boolean
load_cu_tu_indexes (void *file)
{
+ static int cu_tu_indexes_read = -1; /* Tri-state variable. */
+
/* If we have already loaded (or tried to load) the CU and TU indexes
then do not bother to repeat the task. */
- if (cu_tu_indexes_read)
- return;
-
- if (load_debug_section (dwp_cu_index, file))
- process_cu_tu_index (&debug_displays [dwp_cu_index].section, 0);
-
- if (load_debug_section (dwp_tu_index, file))
- process_cu_tu_index (&debug_displays [dwp_tu_index].section, 0);
+ if (cu_tu_indexes_read == -1)
+ {
+ cu_tu_indexes_read = TRUE;
+
+ if (load_debug_section (dwp_cu_index, file))
+ if (! process_cu_tu_index (&debug_displays [dwp_cu_index].section, 0))
+ cu_tu_indexes_read = FALSE;
+
+ if (load_debug_section (dwp_tu_index, file))
+ if (! process_cu_tu_index (&debug_displays [dwp_tu_index].section, 0))
+ cu_tu_indexes_read = FALSE;
+ }
- cu_tu_indexes_read = 1;
+ return (bfd_boolean) cu_tu_indexes_read;
}
/* Find the set of sections that includes section SHNDX. */
@@ -7426,7 +7431,8 @@ find_cu_tu_set (void *file, unsigned int shndx)
{
unsigned int i;
- load_cu_tu_indexes (file);
+ if (! load_cu_tu_indexes (file))
+ return NULL;
/* Find SHNDX in the shndx pool. */
for (i = 0; i < shndx_pool_used; i++)
diff --git a/binutils/readelf.c b/binutils/readelf.c
index fd23b6b..3950412 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -675,8 +675,14 @@ find_section_in_set (const char * name, unsigned int * set)
if (set != NULL)
{
while ((i = *set++) > 0)
- if (streq (SECTION_NAME (section_headers + i), name))
- return section_headers + i;
+ {
+ /* See PR 21156 for a reproducer. */
+ if (i >= elf_header.e_shnum)
+ continue; /* FIXME: Should we issue an error message ? */
+
+ if (streq (SECTION_NAME (section_headers + i), name))
+ return section_headers + i;
+ }
}
return find_section (name);
--
2.13.0
