SOURCES/binutils-CVE-2022-4285.patch

@@ -0,0 +1,13 @@
+--- binutils.orig/bfd/elf.c	2022-12-13 15:21:20.040233487 +0000
++++ binutils-2.39/bfd/elf.c	2022-12-13 15:22:33.580986232 +0000
+@@ -8868,7 +8868,9 @@ _bfd_elf_slurp_version_tables (bfd *abfd
+ 	  bfd_set_error (bfd_error_file_too_big);
+ 	  goto error_return_verref;
+ 	}
+-      elf_tdata (abfd)->verref = (Elf_Internal_Verneed *) bfd_alloc (abfd, amt);
++      if (amt == 0)
++       goto error_return_verref;
++      elf_tdata (abfd)->verref = (Elf_Internal_Verneed *) bfd_zalloc (abfd, amt);
+       if (elf_tdata (abfd)->verref == NULL)
+ 	goto error_return_verref;
+ 

SPECS/binutils.spec

@@ -42,7 +42,7 @@
 Summary: A GNU collection of binary utilities
 Name: %{?scl_prefix}%{?cross}binutils%{?_with_debug:-debug}
 Version: 2.38
-Release: 15%{?dist}
+Release: 17%{?dist}
 License: GPLv3+
 URL: https://sourceware.org/binutils
 
@@ -308,6 +308,10 @@ Patch23: binutils-indirect-symbols.patch
 # Lifetime: Fixed in 2.39
 Patch24: binutils-bfd-DWARF-improvements.patch
 
+# Purpose:  Fix a illegal memory acess parsing corrupt files.
+# Lifetime: Fixed in 2.40
+Patch25: binutils-CVE-2022-4285.patch
+
 #----------------------------------------------------------------------------
 
 Provides: bundled(libiberty)
@@ -319,7 +323,6 @@ BuildRequires: automake
 # Note - during GTS bootstrap these have to be changed to the systemOS versions.
 BuildRequires: %{?scl_prefix}gcc
 BuildRequires: %{?scl_prefix}annobin-plugin-gcc
-%define gcc_for_libraries %{?_scl_root}/usr/bin/gcc
 # Note - during GTS bootstrap it may be necessary to build the binutils without
 # annobin annotations.
 # %%undefine _annotated_build
@@ -379,20 +382,21 @@ BuildRequires: dejagnu, zlib-static, glibc-static, sharutils, bc, libstdc++
 # We also need rm.
 Requires(post): coreutils
 
-# On ARM EABI systems, we do want -gnueabi to be part of the
-# target triple.
-%ifnarch %{arm}
-%define _gnu %{nil}
-%endif
-
 %if %{with debuginfod}
 BuildRequires: elfutils-debuginfod-client-devel
 %endif
 
 %{?scl:Requires:%scl_runtime}
+
 Requires(post):  %{alternatives_cmd}
 Requires(preun): %{alternatives_cmd}
 
+# On ARM EABI systems, we do want -gnueabi to be part of the
+# target triple.
+%ifnarch %{arm}
+%define _gnu %{nil}
+%endif
+
 %{!?ld_bfd_priority: %global ld_bfd_priority    50}
 
 # BZ 1924068.  Since applications that use the BFD library are
@@ -422,7 +426,7 @@ converting addresses to file and line).
 
 %package devel
 Summary: BFD and opcodes static and dynamic libraries and header files
-Provides: binutils-static = %{version}-%{release}
+Provides: %{?scl_prefix}binutils-static = %{version}-%{release}
 Requires: zlib-devel
 Requires: %{?scl_prefix}binutils = %{version}-%{release}
 # BZ 1215242: We need touch...
@@ -448,7 +452,7 @@ using libelf instead of BFD.
 
 %package gold
 Summary: The GOLD linker, a faster alternative to the BFD linker
-Provides: binutils-gold = %{version}-%{release}
+Provides: %{?scl_prefix}binutils-gold = %{version}-%{release}
 Requires: %{?scl_prefix}binutils >= %{version}
 
 # Gold needs bison in order to build gold/yyscript.c.
@@ -719,13 +723,17 @@ fi
 make prefix=%{buildroot}%{_prefix} infodir=%{buildroot}%{_infodir} install-info
 %endif
 
+# Make sure that we run the follow make commands in the same environment as
+# the build.  In particular they must use the SCL versions of gcc and the
+# binutis.
+# The sed command converts scl-gcc-toolset-12- into scl-gcc-toolset-12
+source scl_source enable `echo %{?scl_prefix} | sed -e 's/-$//'`
+
 # Rebuild libiberty.a with -fPIC.
 # Future: Remove it together with its header file, projects should bundle it.
 %make_build -C libiberty clean
 %set_build_flags
-# %%make_build CC=%gcc_for_libraries CFLAGS="-fPIC $CFLAGS" -C libiberty
-# FIXME: Using -g0 to work around bug in installed GTS-12 binutils.  Remove once fixed.
-%make_build CC=%gcc_for_libraries CFLAGS="-fPIC $CFLAGS -g0" -C libiberty
+%make_build CFLAGS="-fPIC $CFLAGS" -C libiberty
 
 %if %{enable_new_dtags}
 export LDFLAGS="$RPM_LD_FLAGS -Wl,--enable-new-dtags"
@@ -736,14 +744,12 @@ export LDFLAGS="$RPM_LD_FLAGS -Wl,--enable-new-dtags"
 # the bfd non-stable ABI.
 %make_build -C bfd clean
 %set_build_flags
-# %make_build CC=%gcc_for_libraries CFLAGS="-g -fPIC $CFLAGS -fvisibility=hidden" -C bfd
-# FIXME: Using -g0 to work around bug in installed GTS-12 binutils.  Remove once fixed.
-%make_build CC=%gcc_for_libraries CFLAGS="-fPIC $CFLAGS -fvisibility=hidden -g0" -C bfd
+%make_build CFLAGS="-fPIC $CFLAGS -fvisibility=hidden" -C bfd
 
 # Rebuild libopcodes.a with -fPIC.
 %make_build -C opcodes clean
 %set_build_flags
-%make_build CFLAGS="-g -fPIC $CFLAGS" -C opcodes
+%make_build CFLAGS="-fPIC $CFLAGS" -C opcodes
 
 install -m 644 bfd/libbfd.a %{buildroot}%{_libdir}
 install -m 644 libiberty/libiberty.a %{buildroot}%{_libdir}
@@ -952,6 +958,12 @@ exit 0
 
 #----------------------------------------------------------------------------
 %changelog
+* Fri Dec 16 2022 Nick Clifton  <nickc@redhat.com> - 2.38-17
+- Fix an illegal memory access parsing a corrupt ELF file.  (#2153220)
+
+* Fri Jul 01 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-16
+- Fix the Provides fields of the binutils-gold and binutils-devel subpackages.  (#2103057)
+
 * Thu Jun 23 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-15
 - Adjust Provides and Requires fields of the sub-packages.
 - Use GTS-12 gcc to build static libraries.