Thu Jan 7 09:47:48 2021 UTC ()
binutils: add upstream fixes for CVE-2020-35448.

>From upstream commit log:

PR26574, heap buffer overflow in _bfd_elf_slurp_secondary_reloc_section

A horribly fuzzed object with section headers inside the ELF header.
Disallow that, and crazy reloc sizes.

	PR 26574
	* elfcode.h (elf_object_p): Sanity check section header offset.
	* elf.c (_bfd_elf_slurp_secondary_reloc_section): Sanity check
	sh_entsize.


(fcambus)
diff -r1.93 -r1.94 pkgsrc/devel/binutils/Makefile
diff -r1.38 -r1.39 pkgsrc/devel/binutils/distinfo
diff -r0 -r1.1 pkgsrc/devel/binutils/patches/patch-bfd_elf.c
diff -r0 -r1.1 pkgsrc/devel/binutils/patches/patch-bfd_elfcode.h
cvs diff -r1.93 -r1.94 pkgsrc/devel/binutils/Makefile (expand / switch to unified diff)

--- pkgsrc/devel/binutils/Makefile 2020/12/20 22:41:31 1.93
+++ pkgsrc/devel/binutils/Makefile 2021/01/07 09:47:47 1.94
@@ -1,17 +1,17 @@ @@ -1,17 +1,17 @@
1# $NetBSD: Makefile,v 1.93 2020/12/20 22:41:31 fcambus Exp $ 1# $NetBSD: Makefile,v 1.94 2021/01/07 09:47:47 fcambus Exp $
2 2
3DISTNAME= binutils-2.35.1 3DISTNAME= binutils-2.35.1
4PKGREVISION= 3 4PKGREVISION= 4
5CATEGORIES= devel 5CATEGORIES= devel
6MASTER_SITES= ${MASTER_SITE_GNU:=binutils/} 6MASTER_SITES= ${MASTER_SITE_GNU:=binutils/}
7EXTRACT_SUFX= .tar.bz2 7EXTRACT_SUFX= .tar.bz2
8 8
9MAINTAINER= fcambus@NetBSD.org 9MAINTAINER= fcambus@NetBSD.org
10HOMEPAGE= https://www.gnu.org/software/binutils/ 10HOMEPAGE= https://www.gnu.org/software/binutils/
11COMMENT= GNU binary utilities 11COMMENT= GNU binary utilities
12LICENSE= gnu-gpl-v2 AND gnu-gpl-v3 AND gnu-lgpl-v2 AND gnu-lgpl-v3 12LICENSE= gnu-gpl-v2 AND gnu-gpl-v3 AND gnu-lgpl-v2 AND gnu-lgpl-v3
13 13
14CONFLICTS= avr-binutils<2.13.2.1nb1 14CONFLICTS= avr-binutils<2.13.2.1nb1
15 15
16USE_PKGLOCALEDIR= yes 16USE_PKGLOCALEDIR= yes
17REPLACE_LOCALEDIR_PATTERNS+= Make-in 17REPLACE_LOCALEDIR_PATTERNS+= Make-in
cvs diff -r1.38 -r1.39 pkgsrc/devel/binutils/distinfo (expand / switch to unified diff)

--- pkgsrc/devel/binutils/distinfo 2020/12/20 19:07:05 1.38
+++ pkgsrc/devel/binutils/distinfo 2021/01/07 09:47:47 1.39
@@ -1,12 +1,14 @@ @@ -1,12 +1,14 @@
1$NetBSD: distinfo,v 1.38 2020/12/20 19:07:05 fcambus Exp $ 1$NetBSD: distinfo,v 1.39 2021/01/07 09:47:47 fcambus Exp $
2 2
3SHA1 (binutils-2.35.1.tar.bz2) = df4eb943bf65df4bbbd0a001efcc98113423c5dd 3SHA1 (binutils-2.35.1.tar.bz2) = df4eb943bf65df4bbbd0a001efcc98113423c5dd
4RMD160 (binutils-2.35.1.tar.bz2) = ed8ad923db716388b83b0234d41abc6beb01c9d6 4RMD160 (binutils-2.35.1.tar.bz2) = ed8ad923db716388b83b0234d41abc6beb01c9d6
5SHA512 (binutils-2.35.1.tar.bz2) = 2828cca9664ae172d6be5f1869f4c7cd39b63a4340c9a5d7c18f30fa06d4ff391394704720872f32f786053f14b27dcafd63c46db7984a8f6ec822f266bb2541 5SHA512 (binutils-2.35.1.tar.bz2) = 2828cca9664ae172d6be5f1869f4c7cd39b63a4340c9a5d7c18f30fa06d4ff391394704720872f32f786053f14b27dcafd63c46db7984a8f6ec822f266bb2541
6Size (binutils-2.35.1.tar.bz2) = 32892584 bytes 6Size (binutils-2.35.1.tar.bz2) = 32892584 bytes
7SHA1 (patch-bfd_cache.c) = e2d96bad350552eacdffa83532f9dc9e15ee9be9 7SHA1 (patch-bfd_cache.c) = e2d96bad350552eacdffa83532f9dc9e15ee9be9
 8SHA1 (patch-bfd_elf.c) = afaea1633f3b7e31c3dc12a0fded5862f6de0dc5
 9SHA1 (patch-bfd_elfcode.h) = db9bfcd489a1160609444bb03c3d08b92d3af8cb
8SHA1 (patch-gold_Makefile.in) = e01d973f9625a1653851f796c123efec37102fbd 10SHA1 (patch-gold_Makefile.in) = e01d973f9625a1653851f796c123efec37102fbd
9SHA1 (patch-gold_options.h) = 65a4cdb67cb4bef6a1891ca66a5fc80c5493c24e 11SHA1 (patch-gold_options.h) = 65a4cdb67cb4bef6a1891ca66a5fc80c5493c24e
10SHA1 (patch-gold_system.h) = 9b4130b5315763daa66e0a91a8be6d1df0d10344 12SHA1 (patch-gold_system.h) = 9b4130b5315763daa66e0a91a8be6d1df0d10344
11SHA1 (patch-gold_testsuite_Makefile.in) = 4babdbb89a989f3f1de66ad44a9603cbd9656f89 13SHA1 (patch-gold_testsuite_Makefile.in) = 4babdbb89a989f3f1de66ad44a9603cbd9656f89
12SHA1 (patch-include_safe-ctype.h) = 66e636f8200ff5e9b4bfa0a5aee13cd072a23887 14SHA1 (patch-include_safe-ctype.h) = 66e636f8200ff5e9b4bfa0a5aee13cd072a23887
File Added: pkgsrc/devel/binutils/patches/Attic/patch-bfd_elf.c
$NetBSD: patch-bfd_elf.c,v 1.1 2021/01/07 09:47:47 fcambus Exp $

Upstream fix for CVE-2020-35448.

	PR 26574
	* elf.c (_bfd_elf_slurp_secondary_reloc_section): Sanity check
	sh_entsize.

--- bfd/elf.c.orig	2020-09-03 14:59:14.000000000 +0000
+++ bfd/elf.c
@@ -12527,7 +12527,9 @@ _bfd_elf_slurp_secondary_reloc_section (
       Elf_Internal_Shdr * hdr = & elf_section_data (relsec)->this_hdr;
 
       if (hdr->sh_type == SHT_SECONDARY_RELOC
-	  && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx)
+	  && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx
+	  && (hdr->sh_entsize == ebd->s->sizeof_rel
+	      || hdr->sh_entsize == ebd->s->sizeof_rela))
 	{
 	  bfd_byte * native_relocs;
 	  bfd_byte * native_reloc;
File Added: pkgsrc/devel/binutils/patches/Attic/patch-bfd_elfcode.h
$NetBSD: patch-bfd_elfcode.h,v 1.1 2021/01/07 09:47:47 fcambus Exp $

Upstream fix for CVE-2020-35448.

	PR 26574
	* elfcode.h (elf_object_p): Sanity check section header offset.

--- bfd/elfcode.h.orig	2020-09-03 14:59:37.000000000 +0000
+++ bfd/elfcode.h
@@ -568,7 +568,7 @@ elf_object_p (bfd *abfd)
 
   /* If this is a relocatable file and there is no section header
      table, then we're hosed.  */
-  if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_type == ET_REL)
+  if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_type == ET_REL)
     goto got_wrong_format_error;
 
   /* As a simple sanity check, verify that what BFD thinks is the
@@ -578,7 +578,7 @@ elf_object_p (bfd *abfd)
     goto got_wrong_format_error;
 
   /* Further sanity check.  */
-  if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_shnum != 0)
+  if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_shnum != 0)
     goto got_wrong_format_error;
 
   ebd = get_elf_backend_data (abfd);
@@ -615,7 +615,7 @@ elf_object_p (bfd *abfd)
       && ebd->elf_osabi != ELFOSABI_NONE)
     goto got_wrong_format_error;
 
-  if (i_ehdrp->e_shoff != 0)
+  if (i_ehdrp->e_shoff >= sizeof (x_ehdr))
     {
       file_ptr where = (file_ptr) i_ehdrp->e_shoff;
 
@@ -807,7 +807,7 @@ elf_object_p (bfd *abfd)
 	}
     }
 
-  if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff != 0)
+  if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff >= sizeof (x_ehdr))
     {
       unsigned int num_sec;