From 131f93b8efcddac984965a250b5391c43ca54ac8 Mon Sep 17 00:00:00 2001 From: Harish Sadineni Date: Thu, 5 Jun 2025 02:03:14 -0700 Subject: [PATCH] binutils: add CVE-2025-1182 patch file to SRC_URI Forgot to add CVE-2025-1182 patch file to SRC_URI in the following commit https://lists.openembedded.org/g/openembedded-core/message/217350 After rebasing the CVE-2025-1180.patch, we encountered hunk errors while applying the CVE-2025-1182.patch, so I have modified the patch accordingly. Signed-off-by: Harish Sadineni Signed-off-by: Steve Sakoman --- .../binutils/binutils-2.38.inc | 1 + .../binutils/binutils/0040-CVE-2025-1182.patch | 18 +++++++++--------- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/meta/recipes-devtools/binutils/binutils-2.38.inc b/meta/recipes-devtools/binutils/binutils-2.38.inc index 01fd03d2f4..085ca2301e 100644 --- a/meta/recipes-devtools/binutils/binutils-2.38.inc +++ b/meta/recipes-devtools/binutils/binutils-2.38.inc @@ -75,5 +75,6 @@ SRC_URI = "\ file://0038-CVE-2025-0840.patch \ file://0039-CVE-2025-1178.patch \ file://0040-CVE-2025-1180.patch \ + file://0040-CVE-2025-1182.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/0040-CVE-2025-1182.patch b/meta/recipes-devtools/binutils/binutils/0040-CVE-2025-1182.patch index 682f633927..03604bfdd4 100644 --- a/meta/recipes-devtools/binutils/binutils/0040-CVE-2025-1182.patch +++ b/meta/recipes-devtools/binutils/binutils/0040-CVE-2025-1182.patch @@ -18,14 +18,14 @@ Signed-off-by: Harish Sadineni diff --git a/bfd/elflink.c b/bfd/elflink.c --- a/bfd/elflink.c +++ b/bfd/elflink.c -@@ -14711,6 +14711,10 @@ - } +@@ -14712,6 +14712,10 @@ + } else - { -+ if (r_symndx >= rcookie->locsymcount) -+ /* This can happen with corrupt input. */ -+ return false; + { ++ if (r_symndx >= rcookie->locsymcount) ++ /* This can happen with corrupt input. */ ++ return false; + - /* It's not a relocation against a global symbol, - but it could be a relocation against a local - symbol for a discarded section. */ + /* It's not a relocation against a global symbol, + but it could be a relocation against a local + symbol for a discarded section. */ -- 2.47.2