From 3edfd25eae3f2c6b2bbdf7d16320fd70f9456c99 Mon Sep 17 00:00:00 2001 From: Nick Clifton Date: Tue, 19 Mar 2019 12:17:25 +0000 Subject: [PATCH 1/2] Disable ld.gold on RISC-V and fix file installation issues. --- binutils.spec | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/binutils.spec b/binutils.spec index 94076d2..92a22c5 100644 --- a/binutils.spec +++ b/binutils.spec @@ -31,7 +31,12 @@ # Use "--without gold" to exclude the gold linker. # The default is to include it. # Note - in the future the gold linker may become deprecated. +%ifnarch riscv64 %bcond_without gold +%else +# RISC-V does not have ld.gold thus disable by default. +%bcond_with gold +%endif # Enable thread support in the GOLD linker. This is particularly # important if plugins to the linker intend to use threads themselves. @@ -80,7 +85,7 @@ Summary: A GNU collection of binary utilities Name: %{?cross}binutils%{?_with_debug:-debug} Version: 2.32 -Release: 9%{?dist} +Release: 10%{?dist} License: GPLv3+ URL: https://sourceware.org/binutils @@ -313,11 +318,12 @@ BuildRequires: libstdc++-static Conflicts: gcc-c++ < 4.0.0 # The higher of these two numbers determines the default ld. -%{!?ld_bfd_priority: %global ld_bfd_priority 50} %{!?ld_gold_priority:%global ld_gold_priority 30} %endif # with gold +%{!?ld_bfd_priority: %global ld_bfd_priority 50} + #---------------------------------------------------------------------------- %prep @@ -703,6 +709,7 @@ exit 0 %if %{with gold} %{_bindir}/%{?cross}ld* %else +%{_bindir}/%{?cross}ld %{_bindir}/%{?cross}ld.bfd %endif @@ -712,6 +719,7 @@ exit 0 %{_infodir}/binutils.info.gz %{_infodir}/gprof.info.gz %{_infodir}/ld.info.gz +%{_infodir}/bfd.info.gz %endif %if %{enable_shared} @@ -722,12 +730,6 @@ exit 0 %if %{isnative} -%if %{with docs} -%{_infodir}/[^b]*info* -%{_infodir}/binutils*info* -%{_infodir}/bfd*info* -%endif - %files devel %{_prefix}/include/* %{_libdir}/lib*.a @@ -739,11 +741,15 @@ exit 0 %if %{with gold} %files gold %{_bindir}/%{?cross}ld.gold -%ghost %{_bindir}/%{?cross}ld %endif +# %%ghost %%{_bindir}/%%{?cross}ld + #---------------------------------------------------------------------------- %changelog +* Mon Mar 18 2019 David Abdurachmanov - 2.32-10 +- Disable ld.gold on RISC-V and fix file installation issues. + * Wed Mar 06 2019 Nick Clifton - 2.32-9 - Stop potential illegal memory access when disassembling an EFI binary. (#1685727) From 5c29c452de5c0e808d8b2b0fcd57cee0918c97b6 Mon Sep 17 00:00:00 2001 From: Nick Clifton Date: Wed, 10 Apr 2019 17:09:17 +0100 Subject: [PATCH 2/2] Fix a stack exhaustion problem in libiberty's name demangling code. --- binutils-CVE-2019-9071.patch | 110 +++++++++++++++++++++++++++++++++++ binutils.spec | 10 +++- 2 files changed, 119 insertions(+), 1 deletion(-) create mode 100644 binutils-CVE-2019-9071.patch diff --git a/binutils-CVE-2019-9071.patch b/binutils-CVE-2019-9071.patch new file mode 100644 index 0000000..f4ef3bc --- /dev/null +++ b/binutils-CVE-2019-9071.patch @@ -0,0 +1,110 @@ +--- binutils.orig/libiberty/cp-demangle.c 2019-04-10 10:31:27.854997707 +0100 ++++ binutils-2.31.1/libiberty/cp-demangle.c 2019-04-10 16:00:35.820350978 +0100 +@@ -858,7 +858,7 @@ CP_STATIC_IF_GLIBCPP_V3 + int + cplus_demangle_fill_name (struct demangle_component *p, const char *s, int len) + { +- if (p == NULL || s == NULL || len == 0) ++ if (p == NULL || s == NULL || len <= 0) + return 0; + p->d_printing = 0; + p->type = DEMANGLE_COMPONENT_NAME; +@@ -4032,7 +4032,7 @@ d_growable_string_callback_adapter (cons + are larger than the actual numbers encountered. */ + + static void +-d_count_templates_scopes (int *num_templates, int *num_scopes, ++d_count_templates_scopes (struct d_print_info *dpi, + const struct demangle_component *dc) + { + if (dc == NULL) +@@ -4052,13 +4052,13 @@ d_count_templates_scopes (int *num_templ + break; + + case DEMANGLE_COMPONENT_TEMPLATE: +- (*num_templates)++; ++ dpi->num_copy_templates++; + goto recurse_left_right; + + case DEMANGLE_COMPONENT_REFERENCE: + case DEMANGLE_COMPONENT_RVALUE_REFERENCE: + if (d_left (dc)->type == DEMANGLE_COMPONENT_TEMPLATE_PARAM) +- (*num_scopes)++; ++ dpi->num_saved_scopes++; + goto recurse_left_right; + + case DEMANGLE_COMPONENT_QUAL_NAME: +@@ -4122,42 +4122,42 @@ d_count_templates_scopes (int *num_templ + case DEMANGLE_COMPONENT_TAGGED_NAME: + case DEMANGLE_COMPONENT_CLONE: + recurse_left_right: +- d_count_templates_scopes (num_templates, num_scopes, +- d_left (dc)); +- d_count_templates_scopes (num_templates, num_scopes, +- d_right (dc)); ++ /* PR 89394 - Check for too much recursion. */ ++ if (dpi->recursion > DEMANGLE_RECURSION_LIMIT) ++ /* FIXME: There ought to be a way to report to the ++ user that the recursion limit has been reached. */ ++ return; ++ ++ ++ dpi->recursion; ++ d_count_templates_scopes (dpi, d_left (dc)); ++ d_count_templates_scopes (dpi, d_right (dc)); ++ -- dpi->recursion; + break; + + case DEMANGLE_COMPONENT_CTOR: +- d_count_templates_scopes (num_templates, num_scopes, +- dc->u.s_ctor.name); ++ d_count_templates_scopes (dpi, dc->u.s_ctor.name); + break; + + case DEMANGLE_COMPONENT_DTOR: +- d_count_templates_scopes (num_templates, num_scopes, +- dc->u.s_dtor.name); ++ d_count_templates_scopes (dpi, dc->u.s_dtor.name); + break; + + case DEMANGLE_COMPONENT_EXTENDED_OPERATOR: +- d_count_templates_scopes (num_templates, num_scopes, +- dc->u.s_extended_operator.name); ++ d_count_templates_scopes (dpi, dc->u.s_extended_operator.name); + break; + + case DEMANGLE_COMPONENT_FIXED_TYPE: +- d_count_templates_scopes (num_templates, num_scopes, +- dc->u.s_fixed.length); ++ d_count_templates_scopes (dpi, dc->u.s_fixed.length); + break; + + case DEMANGLE_COMPONENT_GLOBAL_CONSTRUCTORS: + case DEMANGLE_COMPONENT_GLOBAL_DESTRUCTORS: +- d_count_templates_scopes (num_templates, num_scopes, +- d_left (dc)); ++ d_count_templates_scopes (dpi, d_left (dc)); + break; + + case DEMANGLE_COMPONENT_LAMBDA: + case DEMANGLE_COMPONENT_DEFAULT_ARG: +- d_count_templates_scopes (num_templates, num_scopes, +- dc->u.s_unary_num.sub); ++ d_count_templates_scopes (dpi, dc->u.s_unary_num.sub); + break; + } + } +@@ -4192,8 +4192,12 @@ d_print_init (struct d_print_info *dpi, + dpi->next_copy_template = 0; + dpi->num_copy_templates = 0; + +- d_count_templates_scopes (&dpi->num_copy_templates, +- &dpi->num_saved_scopes, dc); ++ d_count_templates_scopes (dpi, dc); ++ /* If we did not reach the recursion limit, then reset the ++ current recursion value back to 0, so that we can print ++ the templates. */ ++ if (dpi->recursion < DEMANGLE_RECURSION_LIMIT) ++ dpi->recursion = 0; + dpi->num_copy_templates *= dpi->num_saved_scopes; + + dpi->current_template = NULL; diff --git a/binutils.spec b/binutils.spec index 92a22c5..6d33bcf 100644 --- a/binutils.spec +++ b/binutils.spec @@ -85,7 +85,7 @@ Summary: A GNU collection of binary utilities Name: %{?cross}binutils%{?_with_debug:-debug} Version: 2.32 -Release: 10%{?dist} +Release: 11%{?dist} License: GPLv3+ URL: https://sourceware.org/binutils @@ -202,6 +202,10 @@ Patch17: binutils-CVE-2019-9077.patch # Lifetime: Fixed in 2.33 Patch18: binutils-disassembling-efi-files.patch +# Purpose: Fix a stack exhaustion problem in libiberty's name demangling code. +# Lifetime: Fixed in 2.33 +Patch19: binutils-CVE-2019-9071.patch + #---------------------------------------------------------------------------- Provides: bundled(libiberty) @@ -346,6 +350,7 @@ Conflicts: gcc-c++ < 4.0.0 %patch16 -p1 %patch17 -p1 %patch18 -p1 +%patch19 -p1 # We cannot run autotools as there is an exact requirement of autoconf-2.59. # FIXME - this is no longer true. Maybe try reinstating autotool use ? @@ -747,6 +752,9 @@ exit 0 #---------------------------------------------------------------------------- %changelog +* Wed Apr 10 2019 Nick Clifton - 2.32-11 +- Fix a stack exhaustion problem in libiberty's name demangling code. (#1680658) + * Mon Mar 18 2019 David Abdurachmanov - 2.32-10 - Disable ld.gold on RISC-V and fix file installation issues.