SOURCES/binutils-CVE-2022-4285.patch

@@ -1,13 +0,0 @@
---- binutils.orig/bfd/elf.c	2022-12-13 15:21:20.040233487 +0000
-+++ binutils-2.39/bfd/elf.c	2022-12-13 15:22:33.580986232 +0000
-@@ -8868,7 +8868,9 @@ _bfd_elf_slurp_version_tables (bfd *abfd
- 	  bfd_set_error (bfd_error_file_too_big);
- 	  goto error_return_verref;
- 	}
--      elf_tdata (abfd)->verref = (Elf_Internal_Verneed *) bfd_alloc (abfd, amt);
-+      if (amt == 0)
-+       goto error_return_verref;
-+      elf_tdata (abfd)->verref = (Elf_Internal_Verneed *) bfd_zalloc (abfd, amt);
-       if (elf_tdata (abfd)->verref == NULL)
- 	goto error_return_verref;
- 

SPECS/binutils.spec

@@ -42,7 +42,7 @@
 Summary: A GNU collection of binary utilities
 Name: %{?scl_prefix}%{?cross}binutils%{?_with_debug:-debug}
 Version: 2.38
-Release: 17%{?dist}
+Release: 0.15%{?dist}
 License: GPLv3+
 URL: https://sourceware.org/binutils
 
@@ -114,7 +114,7 @@ URL: https://sourceware.org/binutils
 %endif
 
 # Default: Not bootstrapping.
-%bcond_with bootstrap
+%bcond_without bootstrap
 # Default: Not debug
 %bcond_with debug
 # Default: Always build documentation.
@@ -308,10 +308,6 @@ Patch23: binutils-indirect-symbols.patch
 # Lifetime: Fixed in 2.39
 Patch24: binutils-bfd-DWARF-improvements.patch
 
-# Purpose:  Fix a illegal memory acess parsing corrupt files.
-# Lifetime: Fixed in 2.40
-Patch25: binutils-CVE-2022-4285.patch
-
 #----------------------------------------------------------------------------
 
 Provides: bundled(libiberty)
@@ -322,10 +318,11 @@ BuildRequires: automake
 # that the version of LTO used matches.
 # Note - during GTS bootstrap these have to be changed to the systemOS versions.
 BuildRequires: %{?scl_prefix}gcc
-BuildRequires: %{?scl_prefix}annobin-plugin-gcc
+#BuildRequires: {?scl_prefix}annobin-plugin-gcc
+%define gcc_for_libraries %{?_scl_root}/usr/bin/gcc
 # Note - during GTS bootstrap it may be necessary to build the binutils without
 # annobin annotations.
-# %%undefine _annotated_build
+%undefine _annotated_build
 
 # Can be dropped once binutils-ld-read-only-script.patch is removed
 BuildRequires: bison
@@ -382,21 +379,20 @@ BuildRequires: dejagnu, zlib-static, glibc-static, sharutils, bc, libstdc++
 # We also need rm.
 Requires(post): coreutils
 
-%if %{with debuginfod}
-BuildRequires: elfutils-debuginfod-client-devel
-%endif
-
-%{?scl:Requires:%scl_runtime}
-
-Requires(post):  %{alternatives_cmd}
-Requires(preun): %{alternatives_cmd}
-
 # On ARM EABI systems, we do want -gnueabi to be part of the
 # target triple.
 %ifnarch %{arm}
 %define _gnu %{nil}
 %endif
 
+%if %{with debuginfod}
+BuildRequires: elfutils-debuginfod-client-devel
+%endif
+
+%{?scl:Requires:%scl_runtime}
+Requires(post):  %{alternatives_cmd}
+Requires(preun): %{alternatives_cmd}
+
 %{!?ld_bfd_priority: %global ld_bfd_priority    50}
 
 # BZ 1924068.  Since applications that use the BFD library are
@@ -426,7 +422,7 @@ converting addresses to file and line).
 
 %package devel
 Summary: BFD and opcodes static and dynamic libraries and header files
-Provides: %{?scl_prefix}binutils-static = %{version}-%{release}
+Provides: binutils-static = %{version}-%{release}
 Requires: zlib-devel
 Requires: %{?scl_prefix}binutils = %{version}-%{release}
 # BZ 1215242: We need touch...
@@ -452,7 +448,7 @@ using libelf instead of BFD.
 
 %package gold
 Summary: The GOLD linker, a faster alternative to the BFD linker
-Provides: %{?scl_prefix}binutils-gold = %{version}-%{release}
+Provides: binutils-gold = %{version}-%{release}
 Requires: %{?scl_prefix}binutils >= %{version}
 
 # Gold needs bison in order to build gold/yyscript.c.
@@ -723,17 +719,13 @@ fi
 make prefix=%{buildroot}%{_prefix} infodir=%{buildroot}%{_infodir} install-info
 %endif
 
-# Make sure that we run the follow make commands in the same environment as
-# the build.  In particular they must use the SCL versions of gcc and the
-# binutis.
-# The sed command converts scl-gcc-toolset-12- into scl-gcc-toolset-12
-source scl_source enable `echo %{?scl_prefix} | sed -e 's/-$//'`
-
 # Rebuild libiberty.a with -fPIC.
 # Future: Remove it together with its header file, projects should bundle it.
 %make_build -C libiberty clean
 %set_build_flags
-%make_build CFLAGS="-fPIC $CFLAGS" -C libiberty
+# %%make_build CC=%gcc_for_libraries CFLAGS="-fPIC $CFLAGS" -C libiberty
+# FIXME: Using -g0 to work around bug in installed GTS-12 binutils.  Remove once fixed.
+%make_build CC=%gcc_for_libraries CFLAGS="-fPIC $CFLAGS -g0" -C libiberty
 
 %if %{enable_new_dtags}
 export LDFLAGS="$RPM_LD_FLAGS -Wl,--enable-new-dtags"
@@ -744,12 +736,14 @@ export LDFLAGS="$RPM_LD_FLAGS -Wl,--enable-new-dtags"
 # the bfd non-stable ABI.
 %make_build -C bfd clean
 %set_build_flags
-%make_build CFLAGS="-fPIC $CFLAGS -fvisibility=hidden" -C bfd
+# %make_build CC=%gcc_for_libraries CFLAGS="-g -fPIC $CFLAGS -fvisibility=hidden" -C bfd
+# FIXME: Using -g0 to work around bug in installed GTS-12 binutils.  Remove once fixed.
+%make_build CC=%gcc_for_libraries CFLAGS="-fPIC $CFLAGS -fvisibility=hidden -g0" -C bfd
 
 # Rebuild libopcodes.a with -fPIC.
 %make_build -C opcodes clean
 %set_build_flags
-%make_build CFLAGS="-fPIC $CFLAGS" -C opcodes
+%make_build CFLAGS="-g -fPIC $CFLAGS" -C opcodes
 
 install -m 644 bfd/libbfd.a %{buildroot}%{_libdir}
 install -m 644 libiberty/libiberty.a %{buildroot}%{_libdir}
@@ -958,12 +952,6 @@ exit 0
 
 #----------------------------------------------------------------------------
 %changelog
-* Fri Dec 16 2022 Nick Clifton  <nickc@redhat.com> - 2.38-17
-- Fix an illegal memory access parsing a corrupt ELF file.  (#2153220)
-
-* Fri Jul 01 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-16
-- Fix the Provides fields of the binutils-gold and binutils-devel subpackages.  (#2103057)
-
 * Thu Jun 23 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-15
 - Adjust Provides and Requires fields of the sub-packages.
 - Use GTS-12 gcc to build static libraries.