diff mbox series

[wrynose] gcc: Fix for CVE-2026-102010

Message ID 20261012062306.2547997-1-Hemanth.KumarMD@windriver.com
State New
Headers show
Series [wrynose] gcc: Fix for CVE-2026-102010 | expand

Commit Message

Hemanth Kumar M D Oct. 12, 2026, 6:22 a.m. UTC 
From: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com>

    PR 127656 use-after-free in libstdc++ pbds binary heap erase_if

    After reallocating the storage the m_a_entries pointer is left dangling
    and the new storage is leaked. Update m_a_entries after reallocation

    References:
    https://nvd.nist.gov/vuln/detail/CVE-2026-102010
    https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127656
    https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=aaa8351f4d2e636f9680a1f0a8ebc2f0a60611e6

Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com>
---
 meta/recipes-devtools/gcc/gcc-15.3.inc        |  1 +
 .../gcc/gcc/0029-CVE-2026-102010.patch        | 73 +++++++++++++++++++
 2 files changed, 74 insertions(+)
 create mode 100644 meta/recipes-devtools/gcc/gcc/0029-CVE-2026-102010.patch
diff mbox series

Patch

diff --git a/meta/recipes-devtools/gcc/gcc-15.3.inc b/meta/recipes-devtools/gcc/gcc-15.3.inc
index 2f74351085..ed719197bc 100644
--- a/meta/recipes-devtools/gcc/gcc-15.3.inc
+++ b/meta/recipes-devtools/gcc/gcc-15.3.inc
@@ -75,6 +75,7 @@  SRC_URI = "${BASEURI} \
            file://0028-fix-gcc-libitm-false-postives-02.patch \
 	    file://0025-gcc-testsuite-tweaks-for-mips-OE.patch \
            file://0001-mapper-localhost-might-not-be-known.patch \
+	   file://0029-CVE-2026-102010.patch \
 "
 
 UNPACKDIR = "${TMPDIR}/work-shared/gcc-${PV}-${PR}/sources"
diff --git a/meta/recipes-devtools/gcc/gcc/0029-CVE-2026-102010.patch b/meta/recipes-devtools/gcc/gcc/0029-CVE-2026-102010.patch
new file mode 100644
index 0000000000..5eed94ab5a
--- /dev/null
+++ b/meta/recipes-devtools/gcc/gcc/0029-CVE-2026-102010.patch
@@ -0,0 +1,73 @@ 
+From 29e51a820d76c766ae417fcba912714337b0eb17 Mon Sep 17 00:00:00 2001
+From: Jonathan Wakely <jwakely@redhat.com>
+Date: Fri, 25 Sep 2026 18:14:34 +0100
+Subject: libstdc++: Fix use-after-free in pbds binary heap (CVE-2026-102010)
+ [PR127656]
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+After reallocating the storage the m_a_entries pointer is left dangling
+and the new storage is leaked.
+
+libstdc++-v3/ChangeLog:
+
+	PR libstdc++/127656
+	* include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp
+	(erase_if): Update m_a_entries after reallocation.
+	* testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc:
+	New test.
+
+CVE: CVE-2026-102010
+
+Upstream-Status: Backport [https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=aaa8351f4d2e636f9680a1f0a8ebc2f0a60611e6]
+
+Reviewed-by: Tomasz Kamiński <tkaminsk@redhat.com>
+Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com>
+(cherry picked from commit aaa8351f4d2e636f9680a1f0a8ebc2f0a60611e6)
+---
+ .../ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp   |  1 +
+ .../ext/pb_ds/regression/priority_queues_erase_if.cc  | 19 +++++++++++++++++++
+ 2 files changed, 20 insertions(+)
+ create mode 100644 libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc
+
+diff --git a/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp b/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp
+index 752688bb8e94..1eec3c9fb334 100644
+--- a/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp
++++ b/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp
+@@ -121,6 +121,7 @@ erase_if(Pred pred)
+       entry_pointer new_entries = s_entry_allocator.allocate(new_size);
+       std::copy(m_a_entries, m_a_entries + left, new_entries);
+       s_entry_allocator.deallocate(m_a_entries, m_actual_size);
++      m_a_entries = new_entries;
+       m_actual_size = new_size;
+       resize_policy::notify_arbitrary(m_actual_size);
+     }
+diff --git a/libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc b/libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc
+new file mode 100644
+index 000000000000..30b8452eff96
+--- /dev/null
++++ b/libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc
+@@ -0,0 +1,19 @@
++// { dg-do run }
++
++// CVE-2026-201020 use-after-free in binary heap erase_if
++
++#include <ext/pb_ds/priority_queue.hpp>
++
++bool is_odd(int v) { return v & 1; }
++
++int main()
++{
++  using __gnu_pbds::priority_queue;
++  using __gnu_pbds::binary_heap_tag;
++  priority_queue<int, std::less<int>, binary_heap_tag> q;
++  q.push(1);
++  q.push(2);
++  q.push(3);
++  q.erase_if(&is_odd);
++  q.clear();
++}
+-- 
+cgit 
+