Debian Patches

Status for abseil/20240722.0-4

Patch Description Author Forwarded Bugs Origin Last update
configure.diff Set package configuration options
Configure Abseil for Debian.

- Set the SONAME appropriately.

- To minimize the possibility of future ABI breakage, treat absl::any,
absl::optional, absl::string_view, and absl::variant as their own types
(rather than aliases for the std:: versions), and compile everything in an
inline namespace.

- Enable upstream's hardened build mode.		 Benjamin Barenblat <bbaren@google.com> not-needed
cpu-features.diff Canonicalize supported CPU feature set
Explicitly set supported CPU features.

- Disable Intel SSE and SSE2 on i386, since Debian supports some i386
processors without those extensions. Keep them enabled on amd64, since all
amd64 processors have them.

- Disable Intel SSSE3 entirely, since no i386 processor supports it and Debian
supports amd64 processors without it.

- Disable NEON on armel and armhf, since no armel processor supports NEON and
Debian supports some armhf processors without it. Keep it enabled on arm64,
since all arm64 processors have it.		 Benjamin Barenblat <bbaren@google.com> not-needed
latomic.diff Use libatomic if necessary
On some architectures, notably armel, Abseil needs symbols defined in
libatomic. Abseil does not currently have a well-developed system to
declare external library dependencies, so just have the linker determine
if anything needs libatomic and add the DT_NEEDED entry where necessary.		 Benjamin Barenblat <bbaren@google.com> no debian
cordz-info-statistics-test.diff no
pkg-config-directives.diff Do not propagate -Wno-... flags into pkg-config files
Lintian doesn't like any -W flags in pkg-config files, even if those flags
disable warnings.		 Benjamin Barenblat <bbaren@google.com> not-needed
CVE-2025-0838.patch [PATCH] Fix potential integer overflow in hash container create/resize

The sized constructors, reserve(), and rehash() methods of
absl::{flat,node}_hash_{set,map} did not impose an upper bound on
their size argument. As a result, it was possible for a caller to pass
a very large size that would cause an integer overflow when computing
the size of the container's backing store. Subsequent accesses to the
container might then access out-of-bounds memory.

The fix is in two parts:

1) Update max_size() to return the maximum number of items that can be
stored in the container

2) Validate the size arguments to the constructors, reserve(), and
rehash() methods, and abort the program when the argument is invalid

We've looked at uses of these containers in Google codebases like
Chrome, and determined this vulnerability is likely to be difficult to
exploit. This is primarily because container sizes are rarely
attacker-controlled.

The bug was discovered by Dmitry Vyukov <dvyukov@google.com>.		 Derek Mauro <dmauro@google.com> no debian https://github.com/abseil/abseil-cpp/commit/5a0e2cb5e3958dd90bb8569a2766622cb74d90c1 2025-01-23

All known versions for source package 'abseil'

Links