[AutoPR- Security] Patch abseil-cpp for CVE-2025-0838 [MEDIUM] (#15779)

Co-authored-by: akhila-guruju <v-guakhila@microsoft.com>

Author: azurelinux-security

SPECS/abseil-cpp/CVE-2025-0838.patch

@@ -0,0 +1,178 @@
+From 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1 Mon Sep 17 00:00:00 2001
+From: Derek Mauro <dmauro@google.com>
+Date: Thu, 23 Jan 2025 06:33:43 -0800
+Subject: [PATCH] Fix potential integer overflow in hash container
+ create/resize
+
+The sized constructors, reserve(), and rehash() methods of
+absl::{flat,node}_hash_{set,map} did not impose an upper bound on
+their size argument. As a result, it was possible for a caller to pass
+a very large size that would cause an integer overflow when computing
+the size of the container's backing store. Subsequent accesses to the
+container might then access out-of-bounds memory.
+
+The fix is in two parts:
+
+1) Update max_size() to return the maximum number of items that can be
+stored in the container
+
+2) Validate the size arguments to the constructors, reserve(), and
+rehash() methods, and abort the program when the argument is invalid
+
+We've looked at uses of these containers in Google codebases like
+Chrome, and determined this vulnerability is likely to be difficult to
+exploit. This is primarily because container sizes are rarely
+attacker-controlled.
+
+The bug was discovered by Dmitry Vyukov <dvyukov@google.com>.
+
+PiperOrigin-RevId: 718841870
+Change-Id: Ic09dc9de140a35dbb45ab9d90f58383cf2de8286
+
+Upstream Patch reference: https://github.com/abseil/abseil-cpp/commit/5a0e2cb5e3958dd90bb8569a2766622cb74d90c1.patch
+---
+ absl/container/internal/raw_hash_set.cc      |  5 +++
+ absl/container/internal/raw_hash_set.h       | 36 +++++++++++++++++++-
+ absl/container/internal/raw_hash_set_test.cc |  8 +++++
+ 3 files changed, 48 insertions(+), 1 deletion(-)
+
+diff --git a/absl/container/internal/raw_hash_set.cc b/absl/container/internal/raw_hash_set.cc
+index 9f8ea51..fc704d6 100644
+--- a/absl/container/internal/raw_hash_set.cc
++++ b/absl/container/internal/raw_hash_set.cc
+@@ -22,6 +22,7 @@
+ 
+ #include "absl/base/attributes.h"
+ #include "absl/base/config.h"
++#include "absl/base/internal/raw_logging.h"
+ #include "absl/base/dynamic_annotations.h"
+ #include "absl/container/internal/container_memory.h"
+ #include "absl/hash/hash.h"
+@@ -375,6 +376,10 @@ void HashSetResizeHelper::GrowSizeIntoSingleGroupTransferable(
+   PoisonSingleGroupEmptySlots(c, slot_size);
+ }
+ 
++void HashTableSizeOverflow() {
++  ABSL_RAW_LOG(FATAL, "Hash table size overflow");
++}
++
+ }  // namespace container_internal
+ ABSL_NAMESPACE_END
+ }  // namespace absl
+diff --git a/absl/container/internal/raw_hash_set.h b/absl/container/internal/raw_hash_set.h
+index 3518bc3..b6124ed 100644
+--- a/absl/container/internal/raw_hash_set.h
++++ b/absl/container/internal/raw_hash_set.h
+@@ -244,6 +244,15 @@ namespace container_internal {
+ #define ABSL_SWISSTABLE_ENABLE_GENERATIONS
+ #endif
+ 
++#ifdef ABSL_SWISSTABLE_ASSERT
++#error ABSL_SWISSTABLE_ASSERT cannot be directly set
++#else
++// We use this macro for assertions that users may see when the table is in an
++// invalid state that sanitizers may help diagnose.
++#define ABSL_SWISSTABLE_ASSERT(CONDITION) \
++  assert((CONDITION) && "Try enabling sanitizers.")
++#endif
++
+ // We use uint8_t so we don't need to worry about padding.
+ using GenerationType = uint8_t;
+ 
+@@ -1017,6 +1026,9 @@ inline size_t SlotOffset(size_t capacity, size_t slot_align, bool has_infoz) {
+ // array.
+ inline size_t AllocSize(size_t capacity, size_t slot_size, size_t slot_align,
+                         bool has_infoz) {
++  ABSL_SWISSTABLE_ASSERT(
++      slot_size <=
++      ((std::numeric_limits<size_t>::max)() - SlotOffset(capacity, slot_align, has_infoz)) / capacity);
+   return SlotOffset(capacity, slot_align, has_infoz) + capacity * slot_size;
+ }
+ 
+@@ -1184,6 +1196,15 @@ inline size_t NormalizeCapacity(size_t n) {
+   return n ? ~size_t{} >> countl_zero(n) : 1;
+ }
+ 
++template <size_t kSlotSize>
++size_t MaxValidCapacity() {
++  return NormalizeCapacity((std::numeric_limits<size_t>::max)() / 4 /
++                           kSlotSize);
++}
++
++// Use a non-inlined function to avoid code bloat.
++[[noreturn]] void HashTableSizeOverflow();
++
+ // General notes on capacity/growth methods below:
+ // - We use 7/8th as maximum load factor. For 16-wide groups, that gives an
+ //   average of two empty slots per group.
+@@ -2093,6 +2114,10 @@ class raw_hash_set {
+       const allocator_type& alloc = allocator_type())
+       : settings_(CommonFields{}, hash, eq, alloc) {
+     if (bucket_count) {
++      if (ABSL_PREDICT_FALSE(bucket_count >
++                             MaxValidCapacity<sizeof(slot_type)>())) {
++        HashTableSizeOverflow();
++      }
+       resize(NormalizeCapacity(bucket_count));
+     }
+   }
+@@ -2286,7 +2311,9 @@ class raw_hash_set {
+   bool empty() const { return !size(); }
+   size_t size() const { return common().size(); }
+   size_t capacity() const { return common().capacity(); }
+-  size_t max_size() const { return (std::numeric_limits<size_t>::max)(); }
++  size_t max_size() const {
++    return CapacityToGrowth(MaxValidCapacity<sizeof(slot_type)>());
++  }
+ 
+   ABSL_ATTRIBUTE_REINITIALIZES void clear() {
+     // Iterating over this container is O(bucket_count()). When bucket_count()
+@@ -2624,6 +2651,9 @@ class raw_hash_set {
+     auto m = NormalizeCapacity(n | GrowthToLowerboundCapacity(size()));
+     // n == 0 unconditionally rehashes as per the standard.
+     if (n == 0 || m > capacity()) {
++      if (ABSL_PREDICT_FALSE(m > MaxValidCapacity<sizeof(slot_type)>())) {
++        HashTableSizeOverflow();
++      }
+       resize(m);
+ 
+       // This is after resize, to ensure that we have completed the allocation
+@@ -2634,6 +2664,9 @@ class raw_hash_set {
+ 
+   void reserve(size_t n) {
+     if (n > size() + growth_left()) {
++      if (ABSL_PREDICT_FALSE(n > max_size())) {
++        HashTableSizeOverflow();
++      }
+       size_t m = GrowthToLowerboundCapacity(n);
+       resize(NormalizeCapacity(m));
+ 
+@@ -3321,5 +3354,6 @@ ABSL_NAMESPACE_END
+ }  // namespace absl
+ 
+ #undef ABSL_SWISSTABLE_ENABLE_GENERATIONS
++#undef ABSL_SWISSTABLE_ASSERT
+ 
+ #endif  // ABSL_CONTAINER_INTERNAL_RAW_HASH_SET_H_
+diff --git a/absl/container/internal/raw_hash_set_test.cc b/absl/container/internal/raw_hash_set_test.cc
+index f9797f5..1f579bf 100644
+--- a/absl/container/internal/raw_hash_set_test.cc
++++ b/absl/container/internal/raw_hash_set_test.cc
+@@ -2678,6 +2678,14 @@ TEST(Table, CountedHash) {
+   }
+ }
+ 
++TEST(Table, MaxSizeOverflow) {
++  size_t overflow = (std::numeric_limits<size_t>::max)();
++  EXPECT_DEATH_IF_SUPPORTED(IntTable t(overflow), "Hash table size overflow");
++  IntTable t;
++  EXPECT_DEATH_IF_SUPPORTED(t.reserve(overflow), "Hash table size overflow");
++  EXPECT_DEATH_IF_SUPPORTED(t.rehash(overflow), "Hash table size overflow");
++}
++
+ }  // namespace
+ }  // namespace container_internal
+ ABSL_NAMESPACE_END
+-- 
+2.43.0
+

SPECS/abseil-cpp/abseil-cpp.spec

@@ -5,12 +5,13 @@
 Summary:        C++ Common Libraries
 Name:           abseil-cpp
 Version:        20240116.0
-Release:        2%{?dist}
+Release:        3%{?dist}
 License:        ASL 2.0
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
 URL:            https://abseil.io
 Source0:        https://github.com/abseil/abseil-cpp/archive/refs/tags/%{version}.tar.gz#/%{name}-%{version}.tar.gz
+Patch0:         CVE-2025-0838.patch
 
 BuildRequires:  cmake >= 3.20.0
 BuildRequires:  gcc
@@ -94,6 +95,9 @@ Development headers for %{name}
 %{_libdir}/pkgconfig/*.pc
 
 %changelog
+* Tue Feb 10 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 20240116.0-3
+- Patch for CVE-2025-0838
+
 * Thu Jul 25 2024 Devin Anderson <danderson@microsoft.com> - 20240116.0-2
 - Change the build type back to 'RelWithDebInfo' so that 'abseil' compiles with
   'NDEBUG' defined so that packages that link to 'abseil' with 'NDEBUG' defined