binutils/binutils-CVE-2025-7545.patch
Nick Clifton 698ef7dd10 Stop excessive memory allocation when copying corrupt files. (#2379829)
Stop illegal memory access when parsing corrupt files.  (#2379836)
2025-07-14 14:52:00 +01:00

38 lines
1.4 KiB
Diff

From 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944 Mon Sep 17 00:00:00 2001
From: "H.J. Lu" <hjl.tools@gmail.com>
Date: Sat, 21 Jun 2025 06:36:56 +0800
Subject: [PATCH] objcopy: Don't extend the output section size
Since the output section contents are copied from the input, don't
extend the output section size beyond the input section size.
PR binutils/33049
* objcopy.c (copy_section): Don't extend the output section
size beyond the input section size.
Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
---
diff -rup binutils-2.43.1.orig/binutils/objcopy.c binutils-2.43.1/binutils/objcopy.c
--- binutils-2.43.1.orig/binutils/objcopy.c 2025-07-14 13:55:09.475539153 +0100
+++ binutils-2.43.1/binutils/objcopy.c 2025-07-14 13:55:21.639628637 +0100
@@ -4665,6 +4665,7 @@ copy_section (bfd *ibfd, sec_ptr isectio
char *to = (char *) memhunk;
char *end = (char *) memhunk + size;
int i;
+ bfd_size_type memhunk_size = size;
/* If the section address is not exactly divisible by the interleave,
then we must bias the from address. If the copy_byte is less than
@@ -4684,6 +4685,11 @@ copy_section (bfd *ibfd, sec_ptr isectio
}
size = (size + interleave - 1 - copy_byte) / interleave * copy_width;
+
+ /* Don't extend the output section size. */
+ if (size > memhunk_size)
+ size = memhunk_size;
+
osection->lma /= interleave;
if (copy_byte < extra)
osection->lma++;
Only in binutils-2.43.1/binutils: objcopy.c.orig