fix(cve): CVE-2025-69649 - PR 33697, fuzzer segfault

debian/changelog

@@ -1,3 +1,15 @@
+binutils (2.41-6deepin15) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-6846
+
+ -- deepin-ci-robot <packages@deepin.org>  Thu, 27 Aug 2026 16:26:08 +0800
+
+binutils (2.41-6deepin14) unstable; urgency=medium
+
+  * fix(cve): CVE-2025-69649
+
+ -- deepin-ci-robot <packages@deepin.org>  Thu, 27 Aug 2026 10:21:53 +0800
+
 binutils (2.41-6deepin12) unstable; urgency=medium
 
   * Remove cross-compiler g++ packages from build dependencies

debian/patches/CVE-2025-69649.patch

@@ -0,0 +1,27 @@
+Description: CVE-2025-69649 - 安全修复
+Author: Alan Modra <amodra@gmail.com>
+Origin: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=66a3492ce68e1ae45b2489bd9a815c39ea5d7f66
+Bug: https://security-tracker.debian.org/tracker/CVE-2025-69649
+Last-Update: 2025-12-08
+---
+diff --git a/binutils/readelf.c b/binutils/readelf.c
+index 97d72d0b95f02846f51b06e284e70178803215e2..b8f5e97b62f71e8a01c158f687698f92acec827e 100644
+--- a/binutils/readelf.c
++++ b/binutils/readelf.c
+@@ -8725,11 +8725,11 @@ process_relocs (Filedata * filedata)
+       size_t i;
+       bool found = false;
+
+-      for (i = 0, section = filedata->section_headers;
+-	   i < filedata->file_header.e_shnum;
+-	   i++, section++)
+-	{
+-	  if (   section->sh_type != SHT_RELA
++      section = filedata->section_headers;
++      if (section != NULL)
++	for (i = 0; i < filedata->file_header.e_shnum; i++, section++)
++	  {
++	    if (   section->sh_type != SHT_RELA
+ 	      && section->sh_type != SHT_REL
+ 	      && section->sh_type != SHT_RELR)
+ 	    continue;

debian/patches/CVE-2026-6846.patch

@@ -0,0 +1,39 @@
+Description: CVE-2026-6846 - 安全修复
+Author: Alan Modra <amodra@gmail.com>
+Origin: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7a089e0302382f4d4e077941156e1eaa68d01393
+Bug: https://security-tracker.debian.org/tracker/CVE-2026-6846
+Last-Update: 2026-04-06
+---
+diff --git a/bfd/xcofflink.c b/bfd/xcofflink.c
+index a2772130..8235d75b 100644
+--- a/bfd/xcofflink.c
++++ b/bfd/xcofflink.c
+@@ -1300,6 +1300,7 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
+   } *reloc_info = NULL;
+   bfd_size_type amt;
+   unsigned short visibility;
++  unsigned int max_target_index;
+
+   keep_syms = obj_coff_keep_syms (abfd);
+
+@@ -1363,7 +1364,19 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
+      order by VMA within a given section, so we handle this by
+      scanning along the relocs as we process the csects.  We index
+      into reloc_info using the section target_index.  */
+-  amt = abfd->section_count + 1;
++  max_target_index = 0;
++  for (o = abfd->section_last; o != NULL; o = o->prev)
++    if (o->target_index != 0)
++      {
++	/* The last section added from the object file will have the
++	   highest target_index.  See coffgen.c coff_real_object_p and
++	   make_a_section_from_file.  Sections added by
++	   xcoff_link_create_extra_sections will have a zero
++	   target_index.  */
++	max_target_index = o->target_index;
++	break;
++      }
++  amt = max_target_index + 1;
+   amt *= sizeof (struct reloc_info_struct);
+   reloc_info = bfd_zmalloc (amt);
+   if (reloc_info == NULL)

debian/patches/series

@@ -204,3 +204,5 @@ CVE-2025-8225.patch
 0016-LoongArch-Fix-incorrect-display-of-FDEs-address-rang.patch
 0017-LoongArch-Use-more-appropriate-assertions-for-the-re.patch
 0018-LoongArch-set-PRSTATUS_SIZE-0x1e0-to-match-kernel-s-.patch
+CVE-2025-69649.patch
+CVE-2026-6846.patch