|
| 1 | +From e8f8cb0a82fe67fcac9ace1efd38b178748a72ca Mon Sep 17 00:00:00 2001 |
| 2 | +From: Sudipta Pandit <sudpandit@microsoft.com> |
| 3 | +Date: Tue, 4 Feb 2025 16:39:33 +0530 |
| 4 | +Subject: [PATCH] Backport patch for CVE-2025-0840 for binutils |
| 5 | + |
| 6 | +Reference: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=baac6c221e9d69335bf41366a1c7d87d8ab2f893 |
| 7 | +--- |
| 8 | + binutils/objdump.c | 10 ++++++---- |
| 9 | + 1 file changed, 6 insertions(+), 4 deletions(-) |
| 10 | + |
| 11 | +diff --git a/binutils/objdump.c b/binutils/objdump.c |
| 12 | +index a7b8303b..98e0271a 100644 |
| 13 | +--- a/binutils/objdump.c |
| 14 | ++++ b/binutils/objdump.c |
| 15 | +@@ -109,7 +109,8 @@ static bool disassemble_all; /* -D */ |
| 16 | + static int disassemble_zeroes; /* --disassemble-zeroes */ |
| 17 | + static bool formats_info; /* -i */ |
| 18 | + static int wide_output; /* -w */ |
| 19 | +-static int insn_width; /* --insn-width */ |
| 20 | ++#define MAX_INSN_WIDTH 49 |
| 21 | ++static unsigned long insn_width; /* --insn-width */ |
| 22 | + static bfd_vma start_address = (bfd_vma) -1; /* --start-address */ |
| 23 | + static bfd_vma stop_address = (bfd_vma) -1; /* --stop-address */ |
| 24 | + static int dump_debugging; /* --debugging */ |
| 25 | +@@ -2762,7 +2763,7 @@ disassemble_bytes (struct disassemble_info *inf, |
| 26 | + } |
| 27 | + else |
| 28 | + { |
| 29 | +- char buf[50]; |
| 30 | ++ char buf[MAX_INSN_WIDTH + 1]; |
| 31 | + unsigned int bpc = 0; |
| 32 | + unsigned int pb = 0; |
| 33 | + |
| 34 | +@@ -5297,8 +5298,9 @@ main (int argc, char **argv) |
| 35 | + break; |
| 36 | + case OPTION_INSN_WIDTH: |
| 37 | + insn_width = strtoul (optarg, NULL, 0); |
| 38 | +- if (insn_width <= 0) |
| 39 | +- fatal (_("error: instruction width must be positive")); |
| 40 | ++ if (insn_width - 1 >= MAX_INSN_WIDTH) |
| 41 | ++ fatal (_("error: instruction width must be in the range 1 to " |
| 42 | ++ XSTRING (MAX_INSN_WIDTH))); |
| 43 | + break; |
| 44 | + case OPTION_INLINES: |
| 45 | + unwind_inlines = true; |
| 46 | +-- |
| 47 | +2.34.1 |
| 48 | + |
0 commit comments