summaryrefslogtreecommitdiff
path: root/gnu/packages/patches/binutils-CVE-2021-45078.patch
diff options
context:
space:
mode:
Diffstat (limited to 'gnu/packages/patches/binutils-CVE-2021-45078.patch')
-rw-r--r--gnu/packages/patches/binutils-CVE-2021-45078.patch257
1 files changed, 0 insertions, 257 deletions
diff --git a/gnu/packages/patches/binutils-CVE-2021-45078.patch b/gnu/packages/patches/binutils-CVE-2021-45078.patch
deleted file mode 100644
index fca692bdb5..0000000000
--- a/gnu/packages/patches/binutils-CVE-2021-45078.patch
+++ /dev/null
@@ -1,257 +0,0 @@
-Fix CVE-2021-45078 (incomplete fix for CVE-2018-12699):
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45078
-https://sourceware.org/bugzilla/show_bug.cgi?id=28694
-
-Patch copied from upstream source repository:
-
-https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=161e87d12167b1e36193385485c1f6ce92f74f02
-
-From 161e87d12167b1e36193385485c1f6ce92f74f02 Mon Sep 17 00:00:00 2001
-From: Alan Modra <amodra@gmail.com>
-Date: Wed, 15 Dec 2021 11:48:42 +1030
-Subject: [PATCH] PR28694, Out-of-bounds write in stab_xcoff_builtin_type
-
- PR 28694
- * stabs.c (stab_xcoff_builtin_type): Make typenum unsigned.
- Negate typenum earlier, simplifying bounds checking. Correct
- off-by-one indexing. Adjust switch cases.
----
- binutils/stabs.c | 87 ++++++++++++++++++++++++------------------------
- 1 file changed, 43 insertions(+), 44 deletions(-)
-
-diff --git a/binutils/stabs.c b/binutils/stabs.c
-index 274bfb0e7fa..83ee3ea5fa4 100644
---- a/binutils/stabs.c
-+++ b/binutils/stabs.c
-@@ -202,7 +202,7 @@ static debug_type stab_find_type (void *, struct stab_handle *, const int *);
- static bool stab_record_type
- (void *, struct stab_handle *, const int *, debug_type);
- static debug_type stab_xcoff_builtin_type
-- (void *, struct stab_handle *, int);
-+ (void *, struct stab_handle *, unsigned int);
- static debug_type stab_find_tagged_type
- (void *, struct stab_handle *, const char *, int, enum debug_type_kind);
- static debug_type *stab_demangle_argtypes
-@@ -3496,166 +3496,167 @@ stab_record_type (void *dhandle ATTRIBUTE_UNUSED, struct stab_handle *info,
-
- static debug_type
- stab_xcoff_builtin_type (void *dhandle, struct stab_handle *info,
-- int typenum)
-+ unsigned int typenum)
- {
- debug_type rettype;
- const char *name;
-
-- if (typenum >= 0 || typenum < -XCOFF_TYPE_COUNT)
-+ typenum = -typenum - 1;
-+ if (typenum >= XCOFF_TYPE_COUNT)
- {
-- fprintf (stderr, _("Unrecognized XCOFF type %d\n"), typenum);
-+ fprintf (stderr, _("Unrecognized XCOFF type %d\n"), -typenum - 1);
- return DEBUG_TYPE_NULL;
- }
-- if (info->xcoff_types[-typenum] != NULL)
-- return info->xcoff_types[-typenum];
-+ if (info->xcoff_types[typenum] != NULL)
-+ return info->xcoff_types[typenum];
-
-- switch (-typenum)
-+ switch (typenum)
- {
-- case 1:
-+ case 0:
- /* The size of this and all the other types are fixed, defined
- by the debugging format. */
- name = "int";
- rettype = debug_make_int_type (dhandle, 4, false);
- break;
-- case 2:
-+ case 1:
- name = "char";
- rettype = debug_make_int_type (dhandle, 1, false);
- break;
-- case 3:
-+ case 2:
- name = "short";
- rettype = debug_make_int_type (dhandle, 2, false);
- break;
-- case 4:
-+ case 3:
- name = "long";
- rettype = debug_make_int_type (dhandle, 4, false);
- break;
-- case 5:
-+ case 4:
- name = "unsigned char";
- rettype = debug_make_int_type (dhandle, 1, true);
- break;
-- case 6:
-+ case 5:
- name = "signed char";
- rettype = debug_make_int_type (dhandle, 1, false);
- break;
-- case 7:
-+ case 6:
- name = "unsigned short";
- rettype = debug_make_int_type (dhandle, 2, true);
- break;
-- case 8:
-+ case 7:
- name = "unsigned int";
- rettype = debug_make_int_type (dhandle, 4, true);
- break;
-- case 9:
-+ case 8:
- name = "unsigned";
- rettype = debug_make_int_type (dhandle, 4, true);
- break;
-- case 10:
-+ case 9:
- name = "unsigned long";
- rettype = debug_make_int_type (dhandle, 4, true);
- break;
-- case 11:
-+ case 10:
- name = "void";
- rettype = debug_make_void_type (dhandle);
- break;
-- case 12:
-+ case 11:
- /* IEEE single precision (32 bit). */
- name = "float";
- rettype = debug_make_float_type (dhandle, 4);
- break;
-- case 13:
-+ case 12:
- /* IEEE double precision (64 bit). */
- name = "double";
- rettype = debug_make_float_type (dhandle, 8);
- break;
-- case 14:
-+ case 13:
- /* This is an IEEE double on the RS/6000, and different machines
- with different sizes for "long double" should use different
- negative type numbers. See stabs.texinfo. */
- name = "long double";
- rettype = debug_make_float_type (dhandle, 8);
- break;
-- case 15:
-+ case 14:
- name = "integer";
- rettype = debug_make_int_type (dhandle, 4, false);
- break;
-- case 16:
-+ case 15:
- name = "boolean";
- rettype = debug_make_bool_type (dhandle, 4);
- break;
-- case 17:
-+ case 16:
- name = "short real";
- rettype = debug_make_float_type (dhandle, 4);
- break;
-- case 18:
-+ case 17:
- name = "real";
- rettype = debug_make_float_type (dhandle, 8);
- break;
-- case 19:
-+ case 18:
- /* FIXME */
- name = "stringptr";
- rettype = NULL;
- break;
-- case 20:
-+ case 19:
- /* FIXME */
- name = "character";
- rettype = debug_make_int_type (dhandle, 1, true);
- break;
-- case 21:
-+ case 20:
- name = "logical*1";
- rettype = debug_make_bool_type (dhandle, 1);
- break;
-- case 22:
-+ case 21:
- name = "logical*2";
- rettype = debug_make_bool_type (dhandle, 2);
- break;
-- case 23:
-+ case 22:
- name = "logical*4";
- rettype = debug_make_bool_type (dhandle, 4);
- break;
-- case 24:
-+ case 23:
- name = "logical";
- rettype = debug_make_bool_type (dhandle, 4);
- break;
-- case 25:
-+ case 24:
- /* Complex type consisting of two IEEE single precision values. */
- name = "complex";
- rettype = debug_make_complex_type (dhandle, 8);
- break;
-- case 26:
-+ case 25:
- /* Complex type consisting of two IEEE double precision values. */
- name = "double complex";
- rettype = debug_make_complex_type (dhandle, 16);
- break;
-- case 27:
-+ case 26:
- name = "integer*1";
- rettype = debug_make_int_type (dhandle, 1, false);
- break;
-- case 28:
-+ case 27:
- name = "integer*2";
- rettype = debug_make_int_type (dhandle, 2, false);
- break;
-- case 29:
-+ case 28:
- name = "integer*4";
- rettype = debug_make_int_type (dhandle, 4, false);
- break;
-- case 30:
-+ case 29:
- /* FIXME */
- name = "wchar";
- rettype = debug_make_int_type (dhandle, 2, false);
- break;
-- case 31:
-+ case 30:
- name = "long long";
- rettype = debug_make_int_type (dhandle, 8, false);
- break;
-- case 32:
-+ case 31:
- name = "unsigned long long";
- rettype = debug_make_int_type (dhandle, 8, true);
- break;
-- case 33:
-+ case 32:
- name = "logical*8";
- rettype = debug_make_bool_type (dhandle, 8);
- break;
-- case 34:
-+ case 33:
- name = "integer*8";
- rettype = debug_make_int_type (dhandle, 8, false);
- break;
-@@ -3664,9 +3665,7 @@ stab_xcoff_builtin_type (void *dhandle, struct stab_handle *info,
- }
-
- rettype = debug_name_type (dhandle, name, rettype);
--
-- info->xcoff_types[-typenum] = rettype;
--
-+ info->xcoff_types[typenum] = rettype;
- return rettype;
- }
-
---
-2.27.0
-
generated by cgit v1.2.3 (git 2.47.1) at 2025-01-31 20:47:36 +0000