Re: [OE-core] [PATCH] binutils: Fix CVE-2025-1148

["Mathieu Dubois-Briand" <mathieu.dubois-briand@bootlin.com>]

On Fri Mar 28, 2025 at 6:50 AM CET, Harish via lists.openembedded.org Sadineni wrote:
> [Edited Message Follows]
>
>
> On 3/25/2025 1:23 PM, Mathieu Dubois-Briand wrote:
> > CAUTION: This email comes from a non Wind River email account!
> > Do not click links or open attachments unless you recognize the sender and know the content is safe.
> >
> > On Wed Mar 19, 2025 at 10:35 AM CET, Harish via lists.openembedded.org Sadineni wrote:
> >> From: Harish Sadineni <Harish.Sadineni@windriver.com>
> >>
> >> A few place dealing with ld script handling made some attempt to free
> >> memory, but this was generally ignored and would be quite a lot of
> >> work to implement.  Instead, use the stat_obstack rather than
> >> mallocing in many more cases.
> >>
> >> Backport a patch from upstream to fix CVE-2025-1148
> >> Upstream-Status: Backport [https://sourceware.org/cgit/binutils-gdb/commit/?id=d4115c2c8d447e297ae353892de89192c1996211]
> >>
> >> Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
> >> ---
> > Hi,
> >
> > Thanks for your patch.
> >
> > I've seen it is already discussed, but as an additional note, current
> > version seems to generate some build error on the autobuilder:
> >
> > ERROR: gdb-16.2-r0 do_package_qa: QA Issue: The /usr/share/info/dir file is not meant to be shipped in a particular package. [infodir]
> >
> > https://autobuilder.yoctoproject.org/valkyrie/#/builders/17/builds/1170
> >
>  I tested "bitbake world" with the same configuration as in qemux86-world-alt with the current patch, and the issue did not occur.
> Typically, errors like "file is not meant to be shipped in a particular package" arise when there is a change in the recipe
> related to installation or packaging.
>

I relaunched the build and it did fail again, twice:

https://autobuilder.yoctoproject.org/valkyrie/#/builders/17/builds/1170
https://autobuilder.yoctoproject.org/valkyrie/#/builders/17/builds/1206

But on the other hand, I confirm I was not able to reproduce it locally
event using the exact same commit as on the AB.

It will try to apply it again on top of my master-next and see how it
goes

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com