diff --git a/SPECS/gdb/CVE-2026-4647.patch b/SPECS/gdb/CVE-2026-4647.patch new file mode 100644 index 00000000000..6df1d5b5476 --- /dev/null +++ b/SPECS/gdb/CVE-2026-4647.patch @@ -0,0 +1,209 @@ +From 2daf9558afb939b63934178116ac979469b21f96 Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Thu, 2 Apr 2026 10:35:00 +0000 +Subject: [PATCH] Backport PR33919: Fix XCOFF relocation bounds and safe + handling in coff-rs6000.c/coff64-rs6000.c; use ARRAY_SIZE and return NULL + howto; remove XCOFF_MAX_* macros from libxcoff.h; adjust messages to %#x + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=9e99dbc1f19ffaf18d0250788951706066ebe7f2 +--- + bfd/coff-rs6000.c | 36 +++++++++++++++++++++--------------- + bfd/coff64-rs6000.c | 34 ++++++++++++++++++++++++++-------- + bfd/libxcoff.h | 4 +--- + 3 files changed, 48 insertions(+), 26 deletions(-) + +diff --git a/bfd/coff-rs6000.c b/bfd/coff-rs6000.c +index 45ba9b3..8886e58 100644 +--- a/bfd/coff-rs6000.c ++++ b/bfd/coff-rs6000.c +@@ -155,8 +155,7 @@ static xcoff_complain_function xcoff_complain_overflow_bitfield_func; + static xcoff_complain_function xcoff_complain_overflow_signed_func; + static xcoff_complain_function xcoff_complain_overflow_unsigned_func; + +-xcoff_reloc_function *const +-xcoff_calculate_relocation[XCOFF_MAX_CALCULATE_RELOCATION] = ++xcoff_reloc_function *const xcoff_calculate_relocation[] = + { + xcoff_reloc_type_pos, /* R_POS (0x00) */ + xcoff_reloc_type_neg, /* R_NEG (0x01) */ +@@ -210,8 +209,7 @@ xcoff_calculate_relocation[XCOFF_MAX_CALCULATE_RELOCATION] = + xcoff_reloc_type_toc, /* R_TOCL (0x31) */ + }; + +-xcoff_complain_function *const +-xcoff_complain_overflow[XCOFF_MAX_COMPLAIN_OVERFLOW] = ++xcoff_complain_function *const xcoff_complain_overflow[] = + { + xcoff_complain_overflow_dont_func, + xcoff_complain_overflow_bitfield_func, +@@ -1156,8 +1154,11 @@ reloc_howto_type xcoff_howto_table[] = + void + xcoff_rtype2howto (arelent *relent, struct internal_reloc *internal) + { +- if (internal->r_type > R_TOCL) +- abort (); ++ if (internal->r_type >= ARRAY_SIZE (xcoff_howto_table)) ++ { ++ relent->howto = NULL; ++ return; ++ } + + /* Default howto layout works most of the time */ + relent->howto = &xcoff_howto_table[internal->r_type]; +@@ -1181,7 +1182,7 @@ xcoff_rtype2howto (arelent *relent, struct internal_reloc *internal) + if (relent->howto->dst_mask != 0 + && (relent->howto->bitsize + != ((unsigned int) internal->r_size & 0x1f) + 1)) +- abort (); ++ relent->howto = NULL; + } + + reloc_howto_type * +@@ -1234,9 +1235,7 @@ _bfd_xcoff_reloc_name_lookup (bfd *abfd ATTRIBUTE_UNUSED, + { + unsigned int i; + +- for (i = 0; +- i < sizeof (xcoff_howto_table) / sizeof (xcoff_howto_table[0]); +- i++) ++ for (i = 0; i < ARRAY_SIZE (xcoff_howto_table); i++) + if (xcoff_howto_table[i].name != NULL + && strcasecmp (xcoff_howto_table[i].name, r_name) == 0) + return &xcoff_howto_table[i]; +@@ -3621,6 +3620,15 @@ xcoff_ppc_relocate_section (bfd *output_bfd, + if (rel->r_type == R_REF) + continue; + ++ if (rel->r_type >= ARRAY_SIZE (xcoff_howto_table)) ++ { ++ /* xgettext:c-format */ ++ _bfd_error_handler (_("%pB: unsupported relocation type %#x"), ++ input_bfd, rel->r_type); ++ bfd_set_error (bfd_error_bad_value); ++ return false; ++ } ++ + /* Retrieve default value in HOWTO table and fix up according + to r_size field, if it can be different. + This should be made during relocation reading but the algorithms +@@ -3639,9 +3647,8 @@ xcoff_ppc_relocate_section (bfd *output_bfd, + + default: + _bfd_error_handler +- (_("%pB: relocatation (%d) at (0x%" BFD_VMA_FMT "x) has wrong" +- " r_rsize (0x%x)\n"), +- input_bfd, rel->r_type, rel->r_vaddr, rel->r_size); ++ (_("%pB: relocation (%#x) at 0x%" PRIx64 " has wrong r_rsize (0x%x)\n"), ++ input_bfd, rel->r_type, (uint64_t) rel->r_vaddr, rel->r_size); + return false; + } + } +@@ -3716,8 +3723,7 @@ xcoff_ppc_relocate_section (bfd *output_bfd, + } + } + +- if (rel->r_type >= XCOFF_MAX_CALCULATE_RELOCATION +- || !((*xcoff_calculate_relocation[rel->r_type]) ++ if (!((*xcoff_calculate_relocation[rel->r_type]) + (input_bfd, input_section, output_bfd, rel, sym, &howto, val, + addend, &relocation, contents))) + return false; +diff --git a/bfd/coff64-rs6000.c b/bfd/coff64-rs6000.c +index 9e9f9c2..66b125f 100644 +--- a/bfd/coff64-rs6000.c ++++ b/bfd/coff64-rs6000.c +@@ -177,8 +177,7 @@ static bool xcoff64_bad_format_hook + /* Relocation functions */ + static xcoff_reloc_function xcoff64_reloc_type_br; + +-xcoff_reloc_function *const +-xcoff64_calculate_relocation[XCOFF_MAX_CALCULATE_RELOCATION] = ++xcoff_reloc_function *const xcoff64_calculate_relocation[] = + { + xcoff_reloc_type_pos, /* R_POS (0x00) */ + xcoff_reloc_type_neg, /* R_NEG (0x01) */ +@@ -1416,8 +1415,11 @@ reloc_howto_type xcoff64_howto_table[] = + void + xcoff64_rtype2howto (arelent *relent, struct internal_reloc *internal) + { +- if (internal->r_type > R_TOCL) +- abort (); ++ if (internal->r_type >= ARRAY_SIZE (xcoff64_howto_table)) ++ { ++ relent->howto = NULL; ++ return; ++ } + + /* Default howto layout works most of the time */ + relent->howto = &xcoff64_howto_table[internal->r_type]; +@@ -1450,7 +1452,7 @@ xcoff64_rtype2howto (arelent *relent, struct internal_reloc *internal) + if (relent->howto->dst_mask != 0 + && (relent->howto->bitsize + != ((unsigned int) internal->r_size & 0x3f) + 1)) +- abort (); ++ relent->howto = NULL; + } + + reloc_howto_type * +@@ -1505,9 +1507,7 @@ xcoff64_reloc_name_lookup (bfd *abfd ATTRIBUTE_UNUSED, + { + unsigned int i; + +- for (i = 0; +- i < sizeof (xcoff64_howto_table) / sizeof (xcoff64_howto_table[0]); +- i++) ++ for (i = 0; i < ARRAY_SIZE (xcoff64_howto_table); i++) + if (xcoff64_howto_table[i].name != NULL + && strcasecmp (xcoff64_howto_table[i].name, r_name) == 0) + return &xcoff64_howto_table[i]; +@@ -1552,6 +1552,15 @@ xcoff64_ppc_relocate_section (bfd *output_bfd, + if (rel->r_type == R_REF) + continue; + ++ if (rel->r_type >= ARRAY_SIZE (xcoff64_howto_table)) ++ { ++ /* xgettext:c-format */ ++ _bfd_error_handler (_("%pB: unsupported relocation type %#x"), ++ input_bfd, rel->r_type); ++ bfd_set_error (bfd_error_bad_value); ++ return false; ++ } ++ + /* Retrieve default value in HOWTO table and fix up according + to r_size field, if it can be different. + This should be made during relocation reading but the algorithms +@@ -1567,6 +1576,15 @@ xcoff64_ppc_relocate_section (bfd *output_bfd, + howto.size = howto.bitsize > 16 ? (howto.bitsize > 32 ? 4 : 2) : 1; + howto.src_mask = howto.dst_mask = N_ONES (howto.bitsize); + break; ++ if (rel->r_type >= ARRAY_SIZE (xcoff64_howto_table)) ++ { ++ /* xgettext:c-format */ ++ _bfd_error_handler (_("%pB: unsupported relocation type %#x"), ++ input_bfd, rel->r_type); ++ bfd_set_error (bfd_error_bad_value); ++ return false; ++ } ++ + + default: + _bfd_error_handler +diff --git a/bfd/libxcoff.h b/bfd/libxcoff.h +index 2eeb503..c6f4b54 100644 +--- a/bfd/libxcoff.h ++++ b/bfd/libxcoff.h +@@ -201,9 +201,7 @@ struct xcoff_backend_data_rec + #define bfd_xcoff_text_align_power(a) ((xcoff_data (a)->text_align_power)) + #define bfd_xcoff_data_align_power(a) ((xcoff_data (a)->data_align_power)) + +-/* xcoff*_ppc_relocate_section macros */ +-#define XCOFF_MAX_CALCULATE_RELOCATION (0x32) +-#define XCOFF_MAX_COMPLAIN_OVERFLOW (4) ++ + /* N_ONES produces N one bits, without overflowing machine arithmetic. */ + #ifdef N_ONES + #undef N_ONES +-- +2.45.4 + diff --git a/SPECS/gdb/gdb.spec b/SPECS/gdb/gdb.spec index b609cb86d2b..01c987f2a19 100644 --- a/SPECS/gdb/gdb.spec +++ b/SPECS/gdb/gdb.spec @@ -1,7 +1,7 @@ Summary: C debugger Name: gdb Version: 11.2 -Release: 10%{?dist} +Release: 11%{?dist} License: GPLv2+ Vendor: Microsoft Corporation Distribution: Mariner @@ -25,6 +25,7 @@ Patch13: fix-infinite-recursion.patch Patch14: CVE-2025-5244.patch Patch15: CVE-2025-11412.patch Patch16: CVE-2025-11414.patch +Patch17: CVE-2026-4647.patch BuildRequires: expat-devel BuildRequires: gcc-c++ BuildRequires: gcc-gfortran @@ -109,6 +110,9 @@ rm -rvf libctf/testsuite %{_mandir}/*/* %changelog +* Thu Apr 02 2026 Azure Linux Security Servicing Account - 11.2-11 +- Patch for CVE-2026-4647 + * Mon Oct 27 2025 Azure Linux Security Servicing Account - 11.2-10 - Patch for CVE-2025-11414, CVE-2025-11412