From 1aed925a7cf4fb253d15d98d1c203af5320e152c Mon Sep 17 00:00:00 2001 From: Sandro Mani Date: Fri, 14 Apr 2023 16:16:11 +0200 Subject: [PATCH] Backport patch for CVE-2023-1972 --- CVE-2023-1972.patch | 22 ++++++++++++++++++++++ mingw-binutils.spec | 8 +++++++- 2 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 CVE-2023-1972.patch diff --git a/CVE-2023-1972.patch b/CVE-2023-1972.patch new file mode 100644 index 0000000..c214363 --- /dev/null +++ b/CVE-2023-1972.patch @@ -0,0 +1,22 @@ +diff -rupN --no-dereference binutils-2.40/bfd/elf.c binutils-2.40-new/bfd/elf.c +--- binutils-2.40/bfd/elf.c 2023-04-14 16:12:16.185323541 +0200 ++++ binutils-2.40-new/bfd/elf.c 2023-04-14 16:12:27.583371759 +0200 +@@ -9048,6 +9048,9 @@ _bfd_elf_slurp_version_tables (bfd *abfd + bfd_set_error (bfd_error_file_too_big); + goto error_return_verdef; + } ++ ++ if (amt == 0) ++ goto error_return_verdef; + elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt); + if (elf_tdata (abfd)->verdef == NULL) + goto error_return_verdef; +@@ -9151,6 +9154,8 @@ _bfd_elf_slurp_version_tables (bfd *abfd + bfd_set_error (bfd_error_file_too_big); + goto error_return; + } ++ if (amt == 0) ++ goto error_return; + elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt); + if (elf_tdata (abfd)->verdef == NULL) + goto error_return; diff --git a/mingw-binutils.spec b/mingw-binutils.spec index c58aeb3..6e05487 100644 --- a/mingw-binutils.spec +++ b/mingw-binutils.spec @@ -4,7 +4,7 @@ Name: mingw-binutils Version: 2.40 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Cross-compiled version of binutils for Win32 and Win64 environments License: GPLv2+ and LGPLv2+ and GPLv3+ and LGPLv3+ @@ -128,6 +128,9 @@ Patch18: binutils-objcopy-note-merge-speedup.patch # # Lifetime: Permanent, but varying with each new rebase. Patch19: binutils-testsuite-fixes.patch +# Backport fix for CVE-2023-1972 +# https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=c22d38baefc5a7a1e1f5cdc9dbb556b1f0ec5c57 +Patch20: CVE-2023-1972.patch BuildRequires: make BuildRequires: gcc @@ -460,6 +463,9 @@ rm -rf %{buildroot}%{_mandir}/man1/* %changelog +* Fri Apr 14 2023 Sandro Mani - 2.40-2 +- Backport fix for CVE-2023-1972 + * Thu Mar 09 2023 Sandro Mani - 2.40-1 - Update to 2.40