crash: update to 9.0.0 and rework how vendored gdb patches are applied

[christopherco]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Update crash to v9.0.0 which has improved crash dump features
and fixes. crash v9.0.0 requires minimum gdb version of 16.2 during
its build.

Previously, gdb tarball was directly uploaded with patches already
applied. This makes future changes difficult to make, and is difficult
to audit.

Instead, use the official gdb source tarball, and split our %prep
source prepping phase to selectively apply patch 0-99 to the
original crash sources while applying patches 100+ to the gdb
sources.

Here is an analysis of the previous CVE fixes applied, and
whether we still need the fixes:

• CVE-2022-37434 - still apply fix to vendored zlib inside gdb.
• CVE-2021-20197 - drop patch. Already applied in updated gdb. See
  commit ID 95b91a043aeaeb546d2fea556d84a2de1e917770
• CVE-2022-47673 - drop patch. Already applied in updated gdb. See
  commit ID 77c225bdeb410cf60da804879ad41622f5f1aa44
• CVE-2022-47696 - drop patch. Already applied in updated gdb. See
  commit ID d12f8998d2d086f0a6606589e5aedb7147e6f2f1
• CVE-2025-11082 - still apply fix to gdb

Signed-off-by: Chris Co chrco@microsoft.com

Does this affect the toolchain?

NO

Associated issues

• https://microsoft.visualstudio.com/OS/_workitems/edit/59965549

Test Methodology

• Pipeline build id: 1018750

[Copilot]

Pull request overview

This PR updates the crash kernel analysis utility from version 8.0.4 to 9.0.0, which requires updating the vendored gdb from version 10.2 to 16.2. The main improvement is a reworked patch application process that uses the official gdb source tarball instead of a pre-patched version, making future maintenance easier and more auditable.

Key Changes:

• Updated crash to 9.0.0 and gdb to 16.2 with corresponding hash updates
• Implemented a patch numbering scheme (0-99 for crash, 100+ for gdb) with selective patch application during the %prep phase
• Consolidated CVE patches: dropped 3 patches already fixed in gdb 16.2 (CVE-2021-20197, CVE-2022-47673, CVE-2022-47696) and kept 2 critical patches (CVE-2022-37434, CVE-2025-11082)

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
cgmanifest.json	Updated crash version and download URL from 8.0.4 to 9.0.0
SPECS/crash/crash.spec	Updated gdb to 16.2 and crash to 9.0.0; reworked %prep section to extract, patch, and repackage gdb sources with new patch numbering scheme
SPECS/crash/crash.signatures.json	Updated SHA256 hashes for crash 9.0.0 and official gdb 16.2 tarballs
SPECS/crash/CVE-2025-11082.patch	Added patch to fix buffer overflow in gdb's .eh_frame parsing
SPECS/crash/CVE-2022-37434.patch	Added patch to fix buffer overflow in vendored zlib's inflate extra field handling

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.