[AUTO-CHERRYPICK] Patch binutils for CVE-2025-1744 [CRITICAL] - branch main (#12896)

Co-authored-by: KavyaSree2610 <92566732+KavyaSree2610@users.noreply.github.com>

Author: CBL-Mariner-Bot

SPECS/binutils/CVE-2025-1744.patch

@@ -0,0 +1,29 @@
+From 4f089501e761cecf2d702f3fe9a42fd2c2c3fe32 Mon Sep 17 00:00:00 2001
+From: kavyasree <kkaitepalli@microsoft.com>
+Date: Tue, 11 Mar 2025 14:15:39 +0530
+Subject: [PATCH] Patch for CVE-2025-1744
+
+Reference: https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d
+---
+ zlib/inflate.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/zlib/inflate.c b/zlib/inflate.c
+index 7be8c636..754f5540 100644
+--- a/zlib/inflate.c
++++ b/zlib/inflate.c
+@@ -764,8 +764,9 @@ int flush;
+                 if (copy > have) copy = have;
+                 if (copy) {
+                     if (state->head != Z_NULL &&
+-                        state->head->extra != Z_NULL) {
+-                        len = state->head->extra_len - state->length;
++                        state->head->extra != Z_NULL &&
++                        (len = state->head->extra_len - state->length) <
++				state->head->extra_max) {
+                         zmemcpy(state->head->extra + len, next,
+                                 len + copy > state->head->extra_max ?
+                                 state->head->extra_max - len : copy);
+-- 
+2.34.1
+

SPECS/binutils/binutils.spec

@@ -21,7 +21,7 @@
 Summary:        Contains a linker, an assembler, and other tools
 Name:           binutils
 Version:        2.37
-Release:        13%{?dist}
+Release:        14%{?dist}
 License:        GPLv2+
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -50,6 +50,7 @@ Patch15:         CVE-2025-1176.patch
 Patch16:         CVE-2025-1181.patch
 Patch17:         CVE-2025-1182.patch
 Patch18:         CVE-2025-1178.patch
+Patch19:	 CVE-2025-1744.patch
 Provides:       bundled(libiberty)
 
 # Moving macro before the "SourceX" tags breaks PR checks parsing the specs.
@@ -306,6 +307,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
 %do_files aarch64-linux-gnu %{build_aarch64}
 
 %changelog
+* Tue Mar 11 2025 Kavya Sree Kaitepalli <kkaitepalli@microsoft.com> - 2.37-14
+- Fix CVE-2025-1744
+
 * Mon Feb 17 2025 Sindhu Karri <lakarri@microsoft.com> - 2.37-13
 - Fix CVE-2025-1178
 

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

@@ -12,8 +12,8 @@ zlib-devel-1.2.13-2.cm2.aarch64.rpm
 file-5.40-3.cm2.aarch64.rpm
 file-devel-5.40-3.cm2.aarch64.rpm
 file-libs-5.40-3.cm2.aarch64.rpm
-binutils-2.37-13.cm2.aarch64.rpm
-binutils-devel-2.37-13.cm2.aarch64.rpm
+binutils-2.37-14.cm2.aarch64.rpm
+binutils-devel-2.37-14.cm2.aarch64.rpm
 gmp-6.2.1-4.cm2.aarch64.rpm
 gmp-devel-6.2.1-4.cm2.aarch64.rpm
 mpfr-4.1.0-2.cm2.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

@@ -12,8 +12,8 @@ zlib-devel-1.2.13-2.cm2.x86_64.rpm
 file-5.40-3.cm2.x86_64.rpm
 file-devel-5.40-3.cm2.x86_64.rpm
 file-libs-5.40-3.cm2.x86_64.rpm
-binutils-2.37-13.cm2.x86_64.rpm
-binutils-devel-2.37-13.cm2.x86_64.rpm
+binutils-2.37-14.cm2.x86_64.rpm
+binutils-devel-2.37-14.cm2.x86_64.rpm
 gmp-6.2.1-4.cm2.x86_64.rpm
 gmp-devel-6.2.1-4.cm2.x86_64.rpm
 mpfr-4.1.0-2.cm2.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

@@ -9,9 +9,9 @@ bash-5.1.8-4.cm2.aarch64.rpm
 bash-debuginfo-5.1.8-4.cm2.aarch64.rpm
 bash-devel-5.1.8-4.cm2.aarch64.rpm
 bash-lang-5.1.8-4.cm2.aarch64.rpm
-binutils-2.37-13.cm2.aarch64.rpm
-binutils-debuginfo-2.37-13.cm2.aarch64.rpm
-binutils-devel-2.37-13.cm2.aarch64.rpm
+binutils-2.37-14.cm2.aarch64.rpm
+binutils-debuginfo-2.37-14.cm2.aarch64.rpm
+binutils-devel-2.37-14.cm2.aarch64.rpm
 bison-3.7.6-2.cm2.aarch64.rpm
 bison-debuginfo-3.7.6-2.cm2.aarch64.rpm
 bzip2-1.0.8-1.cm2.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

@@ -9,10 +9,10 @@ bash-5.1.8-4.cm2.x86_64.rpm
 bash-debuginfo-5.1.8-4.cm2.x86_64.rpm
 bash-devel-5.1.8-4.cm2.x86_64.rpm
 bash-lang-5.1.8-4.cm2.x86_64.rpm
-binutils-2.37-13.cm2.x86_64.rpm
-binutils-aarch64-linux-gnu-2.37-13.cm2.x86_64.rpm
-binutils-debuginfo-2.37-13.cm2.x86_64.rpm
-binutils-devel-2.37-13.cm2.x86_64.rpm
+binutils-2.37-14.cm2.x86_64.rpm
+binutils-aarch64-linux-gnu-2.37-14.cm2.x86_64.rpm
+binutils-debuginfo-2.37-14.cm2.x86_64.rpm
+binutils-devel-2.37-14.cm2.x86_64.rpm
 bison-3.7.6-2.cm2.x86_64.rpm
 bison-debuginfo-3.7.6-2.cm2.x86_64.rpm
 bzip2-1.0.8-1.cm2.x86_64.rpm
@@ -47,7 +47,7 @@ cracklib-lang-2.9.7-5.cm2.x86_64.rpm
 createrepo_c-0.17.5-1.cm2.x86_64.rpm
 createrepo_c-debuginfo-0.17.5-1.cm2.x86_64.rpm
 createrepo_c-devel-0.17.5-1.cm2.x86_64.rpm
-cross-binutils-common-2.37-13.cm2.noarch.rpm
+cross-binutils-common-2.37-14.cm2.noarch.rpm
 cross-gcc-common-11.2.0-8.cm2.noarch.rpm
 curl-8.8.0-5.cm2.x86_64.rpm
 curl-debuginfo-8.8.0-5.cm2.x86_64.rpm