SOURCES/binutils-CVE-2022-4285.patch

@@ -0,0 +1,13 @@
+--- binutils.orig/bfd/elf.c	2022-12-13 15:21:20.040233487 +0000
++++ binutils-2.39/bfd/elf.c	2022-12-13 15:22:33.580986232 +0000
+@@ -8868,7 +8868,9 @@ _bfd_elf_slurp_version_tables (bfd *abfd
+ 	  bfd_set_error (bfd_error_file_too_big);
+ 	  goto error_return_verref;
+ 	}
+-      elf_tdata (abfd)->verref = (Elf_Internal_Verneed *) bfd_alloc (abfd, amt);
++      if (amt == 0)
++       goto error_return_verref;
++      elf_tdata (abfd)->verref = (Elf_Internal_Verneed *) bfd_zalloc (abfd, amt);
+       if (elf_tdata (abfd)->verref == NULL)
+ 	goto error_return_verref;
+ 

SOURCES/binutils-testsuite-fixes.patch

@@ -881,7 +881,7 @@ diff -rup binutils.orig/ld/testsuite/ld-plugin/plugin.exp binutils-2.38/ld/tests
      $testobjfiles tmpdir/libempty.a $libs" "" "" "" {{ld plugin-30.d}} "main.x" ] \
  ]
  
-+if { [istarget "powerpc*-*-linux*"] }
++if { [istarget "powerpc*-*-linux*"] } {
 +    return
 +}
 +
@@ -921,7 +921,7 @@ diff -rup binutils.orig/ld/testsuite/ld-elf/linux-x86.exp binutils-2.38/ld/tests
      ] \
  ]
  
-+if { [istarget "i[3-6]86-*-*"] } {
++if { [istarget "i?86-*-*"] } {
 +    return
 +}
 +
@@ -959,7 +959,7 @@ diff -rup binutils.orig/ld/testsuite/ld-vsb/vsb.exp binutils-2.38/ld/testsuite/l
      }
  }
  
-+if { [istarget "i[3-6]86-*-*"] } {
++if { [istarget "i?86-*-*"] } {
 +    set support_protected "no"
 +}
 +
@@ -973,7 +973,7 @@ diff -rup binutils.orig/ld/testsuite/lib/ld-lib.exp binutils-2.38/ld/testsuite/l
  	return 1
      }
  
-+    if [istarget "i[3-6]86-*-*"] } {
++    if { [istarget "i?86-*-*"] } {
 +	return 1
 +    }
 +

SPECS/binutils.spec

@@ -1,11 +1,6 @@
 
-
+%define __python /opt/rh/gcc-toolset-9/root/usr/bin/python3
-%{?scl_package:%global scl gcc-toolset-12}
+%{?scl:%{?scl_package:%scl_package binutils}}
-%global scl_prefix gcc-toolset-12-
-BuildRequires: scl-utils-build
-
-%global __python /usr/bin/python3
-%{?scl:%scl_package binutils}
 
 # Determine if this is a native build or a cross build.
 #
@@ -47,7 +42,7 @@ BuildRequires: scl-utils-build
 Summary: A GNU collection of binary utilities
 Name: %{?scl_prefix}%{?cross}binutils%{?_with_debug:-debug}
 Version: 2.38
-Release: 19%{?dist}
+Release: 17%{?dist}
 License: GPLv3+
 URL: https://sourceware.org/binutils
 
@@ -313,25 +308,24 @@ Patch23: binutils-indirect-symbols.patch
 # Lifetime: Fixed in 2.39
 Patch24: binutils-bfd-DWARF-improvements.patch
 
+# Purpose:  Fix a illegal memory acess parsing corrupt files.
+# Lifetime: Fixed in 2.40
+Patch25: binutils-CVE-2022-4285.patch
+
 #----------------------------------------------------------------------------
 
 Provides: bundled(libiberty)
 BuildRequires: autoconf
 BuildRequires: automake
 
-# Use the GTS gcc to build the binutils so that the built static libraries
+# Use the GTS gcc to build the static libraries (libbfd.a libiberty.a) so
-# (libfd.a, libopcodes.a libiberty.a) use the same LTO version as the one
+# that the version of LTO used matches.
-# that will be used by consumers of GTS binutils.
 # Note - during GTS bootstrap these have to be changed to the systemOS versions.
 BuildRequires: %{?scl_prefix}gcc
-BuildRequires: %{?scl_prefix}gcc-c++
 BuildRequires: %{?scl_prefix}annobin-plugin-gcc
-BuildRequires: %{?scl_prefix}gcc-plugin-annobin
-%define gcc_for_libraries %{?_scl_root}/usr/bin/gcc
-%define gxx_for_libraries %{?_scl_root}/usr/bin/g++
 # Note - during GTS bootstrap it may be necessary to build the binutils without
 # annobin annotations.
-%undefine _annotated_build
+# %%undefine _annotated_build
 
 # Can be dropped once binutils-ld-read-only-script.patch is removed
 BuildRequires: bison
@@ -616,8 +610,6 @@ esac
 
 # We could improve the cross build's size by setting --enable-shared but
 # the produced binaries may be less convenient in the embedded environment.
-CC=%gcc_for_libraries \
-CXX=%gxx_for_libraries \
 %configure \
   --quiet \
   --build=%{_target_platform} --host=%{_target_platform} \
@@ -731,6 +723,12 @@ fi
 make prefix=%{buildroot}%{_prefix} infodir=%{buildroot}%{_infodir} install-info
 %endif
 
+# Make sure that we run the follow make commands in the same environment as
+# the build.  In particular they must use the SCL versions of gcc and the
+# binutis.
+# The sed command converts scl-gcc-toolset-12- into scl-gcc-toolset-12
+source scl_source enable `echo %{?scl_prefix} | sed -e 's/-$//'`
+
 # Rebuild libiberty.a with -fPIC.
 # Future: Remove it together with its header file, projects should bundle it.
 %make_build -C libiberty clean
@@ -746,7 +744,7 @@ export LDFLAGS="$RPM_LD_FLAGS -Wl,--enable-new-dtags"
 # the bfd non-stable ABI.
 %make_build -C bfd clean
 %set_build_flags
-%make_build CFLAGS="-fPIC $CFLAGS -fvisibility=hidden" LD=%gcc_for_libraries -C bfd 
+%make_build CFLAGS="-fPIC $CFLAGS -fvisibility=hidden" -C bfd
 
 # Rebuild libopcodes.a with -fPIC.
 %make_build -C opcodes clean
@@ -960,74 +958,62 @@ exit 0
 
 #----------------------------------------------------------------------------
 %changelog
-* Thu Aug 17 2023 Nick Clifton  <nickc@redhat.comn> - 2.38-19
+* Fri Dec 16 2022 Nick Clifton  <nickc@redhat.com> - 2.38-17
-- Add a build requirement on gcc-plugin-annobin.  (#2216456)
+- Fix an illegal memory access parsing a corrupt ELF file.  (#2153220)
-
-* Tue Aug 15 2023 Nick Clifton  <nickc@redhat.comn> - 2.38-18
-- Use z-stream NVR: Fix the Provides fields of the binutils-gold and binutils-devel subpackages.  (#2216456)
-
-* Thu Jul 20 2023 Nick Clifton  <nickc@redhat.comn> - 2.38-17.1
-- Use z-stream NVR: Fix the Provides fields of the binutils-gold and binutils-devel subpackages.  (#2220917)
-
-* Wed Jun 21 2023 Nick Clifton  <nickc@redhat.comn> - 2.38-17
-- NVR Bump: Fix the Provides fields of the binutils-gold and binutils-devel subpackages.  (#2216446)
 
 * Fri Jul 01 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-16
-- Fix the Provides fields of the binutils-gold and binutils-devel subpackages.  (#2103056)
+- Fix the Provides fields of the binutils-gold and binutils-devel subpackages.  (#2103057)
 
-* Mon Jun 27 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-15
+* Thu Jun 23 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-15
-- Use GTS-12 gcc to build static libraries.  (#2101443)
+- Adjust Provides and Requires fields of the sub-packages.
+- Use GTS-12 gcc to build static libraries.
 
-* Mon Jun 20 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-14
+* Wed Jun 08 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-12
-- Adjust Provides, Obsoletes and Requires fields of the sub-packages.
+- Fix bug preventing the linker tests from running.
 
-* Thu Jun 16 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-13
+* Mon Jun 06 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-11
-- NVR bump to allow rebuild with the correct tag (again).
+- Fix selection of 'alternatives' program.  (#2093951)
 
-* Tue Jun 14 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-12
+* Tue May 24 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-10
-- NVR bump to allow rebuild with the correct tag.
+- Fix Requires: fields to work with scl.
 
-* Tue Jun 14 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-11
+* Mon May 16 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-9
-- Add gating.yaml file.
+- Add support to the BFD library for DWARF info generated by Clang 14.  (#2074396)
-- Fix reference to LD_FLAGS..
 
-* Mon Jun 13 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-10
+* Fri May 13 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-8
-- Add support to the BFD library for DWARF info generated by Clang 14.  (#2087104)
+- Initial import of Fedora Rawhide binutils to GTS12/RHEL8.  (#2077448)
 
-* Mon Jun 13 2022 Nick Clifton  <nickc@redhat.com> - 2.38-9
+* Mon Apr 04 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-8
-- NVR bump to allow rebuild.
-
-* Mon Apr 04 2022 Nick Clifton  <nickc@redhat.com> - 2.38-8
 - Fix linker testsuite failures.
 
-* Wed Mar 30 2022 Nick Clifton  <nickc@redhat.com> - 2.38-7
+* Wed Mar 30 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-7
 - Fix a bug handling indirect symbols.  (PR 28879) (#2068343)
 
-* Thu Mar 10 2022 Nick Clifton  <nickc@redhat.com> - 2.38-6
+* Thu Mar 10 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-6
 - Simplify the assembler's evaluation of chained .loc view expressions.  [Second attempt]  (#2059646)
 
-* Thu Mar 10 2022 Nick Clifton  <nickc@redhat.com> - 2.38-5
+* Thu Mar 10 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-5
 - Add an option to objdump/readelf to disable accessing debuginfod servers.  (#2051741)
 
-* Wed Mar 09 2022 Nick Clifton  <nickc@redhat.com> - 2.38-4
+* Wed Mar 09 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-4
 - Simplify the assembler's evaluation of chained .loc view expressions.  (#2059646)
 
-* Mon Feb 28 2022 Nick Clifton  <nickc@redhat.com> - 2.38-3
+* Mon Feb 28 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-3
 - Do not export any windows tools (if they were built).  (#2057636)
 
-* Wed Feb 16 2022 Nick Clifton  <nickc@redhat.com> - 2.38-2
+* Wed Feb 16 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-2
 - Add support for specifying a section type in linker scripts.  (#2052801)
 
-* Wed Feb 09 2022 Nick Clifton  <nickc@redhat.com> - 2.38-1
+* Wed Feb 09 2022 Nick Clifton  <nickc@redhat.comn> - 2.38-1
 - Rebase on GNU Binutils 2.38.
 
-* Thu Jan 27 2022 Nick Clifton  <nickc@redhat.com> - 2.37-25
+* Thu Jan 27 2022 Nick Clifton  <nickc@redhat.comn> - 2.37-25
 - Borrow a patch from the GCC package to stop libtool from inserting needless runpaths into binaries.  (#2030667)
 
 * Wed Jan 19 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.37-24
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
 
-* Mon Dec 20 2021 Nick Clifton  <nickc@redhat.com> - 2.37-23
+* Mon Dec 20 2021 Nick Clifton  <nickc@redhat.comn> - 2.37-23
 - Fix a potential illegal memory access parsing a COFF format file.  (#2033716)
 
 * Thu Dec 02 2021 Luca Boccassi  <luca.boccassi@microsoft.com> - 2.37-22
@@ -2144,8 +2130,7 @@ exit 0
 - Retire: binutils-2.24-corrupt-ar.patch
 
 * Thu Nov 13 2014 Nick Clifton <nickc@redhat.com> - 2.24-29
-- Fix problems with the ar program reported in FSF PR 17533.
+- Fix problems with the ar program reported in FSF PR 17533.  (#1162666, #1162655)
-  Resolves: BZ #1162666, #1162655
 
 * Fri Oct 31 2014 Nick Clifton <nickc@redhat.com> - 2.24-28
 - Fix buffer overrun in ihex parser.
@@ -2157,16 +2142,13 @@ exit 0
 - Fix memory corruption bug introduced by the previous patch.
 
 * Tue Oct 28 2014 Nick Clifton <nickc@redhat.com> - 2.24-26
-- Import patches for PR/17510 and PR/17512 to fix reading corrupt ELF binaries.
+- Import patches for PR/17510 and PR/17512 to fix reading corrupt ELF binaries.  (#1157276, #1157277)
-  Resolves: BZ #1157276, #1157277
 
 * Mon Oct 27 2014 Nick Clifton <nickc@redhat.com> - 2.24-25
-- Import patch from mainline to fix seg-fault when reading corrupt group headers.
+- Import patch from mainline to fix seg-fault when reading corrupt group headers.  (#1157276)
-  Resolves: BZ #1157276
 
 * Fri Oct 24 2014 Nick Clifton <nickc@redhat.com> - 2.24-24
-- Import patch from mainline to fix seg-fault when reading corrupt srec fields.
+- Import patch from mainline to fix seg-fault when reading corrupt srec fields.  (#1156272)
-  Resolves: BZ #1156272
 
 * Mon Aug 25 2014 Kyle McMartin <kmcmarti@redhat.com> - 2.24-23
 - aarch64: increase common page size to 64KB