[AUTO-CHERRYPICK] Patch binutils for CVE-2025-1744 [CRITICAL] - branch 3.0-dev (#12925)

Co-authored-by: KavyaSree2610 <92566732+KavyaSree2610@users.noreply.github.com>

Author: CBL-Mariner-Bot

SPECS/binutils/CVE-2025-1744.patch

@@ -0,0 +1,28 @@
+From 4f089501e761cecf2d702f3fe9a42fd2c2c3fe32 Mon Sep 17 00:00:00 2001
+From: kavyasree <kkaitepalli@microsoft.com>
+Date: Tue, 11 Mar 2025 14:15:39 +0530
+Subject: [PATCH] Patch for CVE-2025-1744
+Reference: https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d
+---
+ zlib/inflate.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/zlib/inflate.c b/zlib/inflate.c
+index 7be8c636..754f5540 100644
+--- a/zlib/inflate.c
++++ b/zlib/inflate.c
+@@ -764,8 +764,9 @@ int flush;
+                 if (copy > have) copy = have;
+                 if (copy) {
+                     if (state->head != Z_NULL &&
+-                        state->head->extra != Z_NULL) {
+-                        len = state->head->extra_len - state->length;
++                        state->head->extra != Z_NULL &&
++                        (len = state->head->extra_len - state->length) <
++				state->head->extra_max) {
+                         zmemcpy(state->head->extra + len, next,
+                                 len + copy > state->head->extra_max ?
+                                 state->head->extra_max - len : copy);
+-- 
+2.34.1
+

SPECS/binutils/binutils.spec

@@ -21,7 +21,7 @@
 Summary:        Contains a linker, an assembler, and other tools
 Name:           binutils
 Version:        2.41
-Release:        4%{?dist}
+Release:        5%{?dist}
 License:        GPLv2+
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -37,6 +37,7 @@ Patch3:         CVE-2025-1178.patch
 Patch4:         CVE-2025-1181.patch
 Patch5:         CVE-2025-1182.patch
 Patch6:         CVE-2025-0840.patch
+Patch7:		CVE-2025-1744.patch
 Provides:       bundled(libiberty)
 
 # Moving macro before the "SourceX" tags breaks PR checks parsing the specs.
@@ -326,6 +327,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
 %do_files aarch64-linux-gnu %{build_aarch64}
 
 %changelog
+* Tue Mar 11 2025 Kavya Sree Kaitepalli <kkaitepalli@microsoft.com> - 2.41-5
+- Fix CVE-2025-1744
+
 * Sun Feb 23 2025 Sudipta Pandit <sudpandit@microsoft.com> - 2.41-4
 - Fix CVE-2025-0840 by backporting upstream patch
 

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

@@ -13,8 +13,8 @@ zlib-devel-1.3.1-1.azl3.aarch64.rpm
 file-5.45-1.azl3.aarch64.rpm
 file-devel-5.45-1.azl3.aarch64.rpm
 file-libs-5.45-1.azl3.aarch64.rpm
-binutils-2.41-4.azl3.aarch64.rpm
-binutils-devel-2.41-4.azl3.aarch64.rpm
+binutils-2.41-5.azl3.aarch64.rpm
+binutils-devel-2.41-5.azl3.aarch64.rpm
 gmp-6.3.0-1.azl3.aarch64.rpm
 gmp-devel-6.3.0-1.azl3.aarch64.rpm
 mpfr-4.2.1-1.azl3.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

@@ -13,8 +13,8 @@ zlib-devel-1.3.1-1.azl3.x86_64.rpm
 file-5.45-1.azl3.x86_64.rpm
 file-devel-5.45-1.azl3.x86_64.rpm
 file-libs-5.45-1.azl3.x86_64.rpm
-binutils-2.41-4.azl3.x86_64.rpm
-binutils-devel-2.41-4.azl3.x86_64.rpm
+binutils-2.41-5.azl3.x86_64.rpm
+binutils-devel-2.41-5.azl3.x86_64.rpm
 gmp-6.3.0-1.azl3.x86_64.rpm
 gmp-devel-6.3.0-1.azl3.x86_64.rpm
 mpfr-4.2.1-1.azl3.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

@@ -30,9 +30,9 @@ bash-5.2.15-3.azl3.aarch64.rpm
 bash-debuginfo-5.2.15-3.azl3.aarch64.rpm
 bash-devel-5.2.15-3.azl3.aarch64.rpm
 bash-lang-5.2.15-3.azl3.aarch64.rpm
-binutils-2.41-4.azl3.aarch64.rpm
-binutils-debuginfo-2.41-4.azl3.aarch64.rpm
-binutils-devel-2.41-4.azl3.aarch64.rpm
+binutils-2.41-5.azl3.aarch64.rpm
+binutils-debuginfo-2.41-5.azl3.aarch64.rpm
+binutils-devel-2.41-5.azl3.aarch64.rpm
 bison-3.8.2-1.azl3.aarch64.rpm
 bison-debuginfo-3.8.2-1.azl3.aarch64.rpm
 bzip2-1.0.8-1.azl3.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

@@ -32,10 +32,10 @@ bash-5.2.15-3.azl3.x86_64.rpm
 bash-debuginfo-5.2.15-3.azl3.x86_64.rpm
 bash-devel-5.2.15-3.azl3.x86_64.rpm
 bash-lang-5.2.15-3.azl3.x86_64.rpm
-binutils-2.41-4.azl3.x86_64.rpm
-binutils-aarch64-linux-gnu-2.41-4.azl3.x86_64.rpm
-binutils-debuginfo-2.41-4.azl3.x86_64.rpm
-binutils-devel-2.41-4.azl3.x86_64.rpm
+binutils-2.41-5.azl3.x86_64.rpm
+binutils-aarch64-linux-gnu-2.41-5.azl3.x86_64.rpm
+binutils-debuginfo-2.41-5.azl3.x86_64.rpm
+binutils-devel-2.41-5.azl3.x86_64.rpm
 bison-3.8.2-1.azl3.x86_64.rpm
 bison-debuginfo-3.8.2-1.azl3.x86_64.rpm
 bzip2-1.0.8-1.azl3.x86_64.rpm
@@ -70,7 +70,7 @@ cracklib-lang-2.9.11-1.azl3.x86_64.rpm
 createrepo_c-1.0.3-1.azl3.x86_64.rpm
 createrepo_c-debuginfo-1.0.3-1.azl3.x86_64.rpm
 createrepo_c-devel-1.0.3-1.azl3.x86_64.rpm
-cross-binutils-common-2.41-4.azl3.noarch.rpm
+cross-binutils-common-2.41-5.azl3.noarch.rpm
 cross-gcc-common-13.2.0-7.azl3.noarch.rpm
 curl-8.11.1-3.azl3.x86_64.rpm
 curl-debuginfo-8.11.1-3.azl3.x86_64.rpm