diff --git a/backport-CVE-2021-32256.patch b/backport-CVE-2021-32256.patch new file mode 100644 index 0000000000000000000000000000000000000000..98e5170b1d221416e4f8d4c6c422ff01068d4154 --- /dev/null +++ b/backport-CVE-2021-32256.patch @@ -0,0 +1,127 @@ +From f10f8617a302f45dae721eae0cd659911f03d864 Mon Sep 17 00:00:00 2001 +From: Nick Clifton +Date: Mon, 31 Jan 2022 14:36:31 +0000 +Subject: [PATCH] Import patch from mainline GCC to fix an infinite recusion in + the Rust demangler. + + PR 98886 + PR 99935 + * rust-demangle.c (struct rust_demangler): Add a recursion + counter. + (demangle_path): Increment/decrement the recursion counter upon + entry and exit. Fail if the counter exceeds a fixed limit. + (demangle_type): Likewise. + (rust_demangle_callback): Initialise the recursion counter, + disabling if requested by the option flags. + +Reference: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f10f8617a302f45dae721eae0cd659911f03d864 +Conflict: Remove libiberty/ChangeLog +--- + libiberty/ChangeLog | 12 ++++++++++ + libiberty/rust-demangle.c | 47 ++++++++++++++++++++++++++++++++++----- + 2 files changed, 53 insertions(+), 6 deletions(-) + +diff --git a/libiberty/rust-demangle.c b/libiberty/rust-demangle.c +index 18c760491bd..3b24d63892a 100644 +--- a/libiberty/rust-demangle.c ++++ b/libiberty/rust-demangle.c +@@ -74,6 +74,12 @@ struct rust_demangler + /* Rust mangling version, with legacy mangling being -1. */ + int version; + ++ /* Recursion depth. */ ++ unsigned int recursion; ++ /* Maximum number of times demangle_path may be called recursively. */ ++#define RUST_MAX_RECURSION_COUNT 1024 ++#define RUST_NO_RECURSION_LIMIT ((unsigned int) -1) ++ + uint64_t bound_lifetime_depth; + }; + +@@ -671,6 +677,15 @@ demangle_path (struct rust_demangler *rdm, int in_value) + if (rdm->errored) + return; + ++ if (rdm->recursion != RUST_NO_RECURSION_LIMIT) ++ { ++ ++ rdm->recursion; ++ if (rdm->recursion > RUST_MAX_RECURSION_COUNT) ++ /* FIXME: There ought to be a way to report ++ that the recursion limit has been reached. */ ++ goto fail_return; ++ } ++ + switch (tag = next (rdm)) + { + case 'C': +@@ -688,10 +703,7 @@ demangle_path (struct rust_demangler *rdm, int in_value) + case 'N': + ns = next (rdm); + if (!ISLOWER (ns) && !ISUPPER (ns)) +- { +- rdm->errored = 1; +- return; +- } ++ goto fail_return; + + demangle_path (rdm, in_value); + +@@ -776,9 +788,15 @@ demangle_path (struct rust_demangler *rdm, int in_value) + } + break; + default: +- rdm->errored = 1; +- return; ++ goto fail_return; + } ++ goto pass_return; ++ ++ fail_return: ++ rdm->errored = 1; ++ pass_return: ++ if (rdm->recursion != RUST_NO_RECURSION_LIMIT) ++ -- rdm->recursion; + } + + static void +@@ -870,6 +888,19 @@ demangle_type (struct rust_demangler *rdm) + return; + } + ++ if (rdm->recursion != RUST_NO_RECURSION_LIMIT) ++ { ++ ++ rdm->recursion; ++ if (rdm->recursion > RUST_MAX_RECURSION_COUNT) ++ /* FIXME: There ought to be a way to report ++ that the recursion limit has been reached. */ ++ { ++ rdm->errored = 1; ++ -- rdm->recursion; ++ return; ++ } ++ } ++ + switch (tag) + { + case 'R': +@@ -1030,6 +1061,9 @@ demangle_type (struct rust_demangler *rdm) + rdm->next--; + demangle_path (rdm, 0); + } ++ ++ if (rdm->recursion != RUST_NO_RECURSION_LIMIT) ++ -- rdm->recursion; + } + + /* A trait in a trait object may have some "existential projections" +@@ -1320,6 +1354,7 @@ rust_demangle_callback (const char *mangled, int options, + rdm.skipping_printing = 0; + rdm.verbose = (options & DMGL_VERBOSE) != 0; + rdm.version = 0; ++ rdm.recursion = (options & DMGL_NO_RECURSE_LIMIT) ? RUST_NO_RECURSION_LIMIT : 0; + rdm.bound_lifetime_depth = 0; + + /* Rust symbols always start with _R (v0) or _ZN (legacy). */ +-- +2.33.0 + diff --git a/gdb.spec b/gdb.spec index e078367fb5aa4dfdd4d7968f816c20b64213d95e..4c1c66e739f4e4d99e71e64674ce8560c8a052a6 100644 --- a/gdb.spec +++ b/gdb.spec @@ -1,6 +1,6 @@ Name: gdb Version: 9.2 -Release: 12 +Release: 13 License: GPLv3+ and GPLv3+ with exceptions and GPLv2+ and GPLv2+ with exceptions and GPL+ and LGPLv2+ and LGPLv3+ and BSD and Public Domain and GFDL-1.3 Source: ftp://sourceware.org/pub/gdb/releases/gdb-%{version}.tar.xz @@ -155,6 +155,7 @@ Patch105: gdb-Set-entry-point-when-text-segment-is.patch Patch106: backport-CVE-2022-48064.patch Patch107: backport-CVE-2025-11082.patch Patch108: backport-CVE-2025-11494.patch +Patch109: backport-CVE-2021-32256.patch BuildRequires: rpm-libs autoconf BuildRequires: readline-devel >= 6.2-4 @@ -401,6 +402,9 @@ rm -f $RPM_BUILD_ROOT%{_datadir}/gdb/python/gdb/command/backtrace.py %{_infodir}/gdb.info* %changelog +* Wed Oct 22 2025 wangxiao - 9.2-13 +- fix CVE-2021-32256 + * Fri Oct 10 2025 Deyuan Fan - 9.2-12 - fix CVE-2025-11494