Fix a potential illegal memory access when linking a corrupt input file.

Resolves: RHEL-130615

.gitignore

@@ -1,2 +1 @@
-binutils-2.19.50.0.1-output-format.sed 
-binutils-with-gold-2.44.tar.xz
+/binutils-with-gold-2.44.tar.xz

binutils-2.19.50.0.1-output-format.sed

@@ -0,0 +1,38 @@
+# Generate OUTPUT_FORMAT line for .so files from the system linker output.
+# Imported from glibc/Makerules.
+
+/ld.*[ 	]-E[BL]/b f
+/collect.*[ 	]-E[BL]/b f
+/OUTPUT_FORMAT[^)]*$/{N
+s/\n[	 ]*/ /
+}
+t o
+: o
+s/^.*OUTPUT_FORMAT(\([^,]*\), \1, \1).*$/OUTPUT_FORMAT(\1)/
+t q
+s/^.*OUTPUT_FORMAT(\([^,]*\), \([^,]*\), \([^,]*\)).*$/\1,\2,\3/
+t s
+s/^.*OUTPUT_FORMAT(\([^,)]*\).*$)/OUTPUT_FORMAT(\1)/
+t q
+d
+: s
+s/"//g
+G
+s/\n//
+s/^\([^,]*\),\([^,]*\),\([^,]*\),B/OUTPUT_FORMAT(\2)/p
+s/^\([^,]*\),\([^,]*\),\([^,]*\),L/OUTPUT_FORMAT(\3)/p
+s/^\([^,]*\),\([^,]*\),\([^,]*\)/OUTPUT_FORMAT(\1)/p
+/,/s|^|*** BUG in libc/scripts/output-format.sed *** |p
+q
+: q
+s/"//g
+p
+q
+: f
+s/^.*[ 	]-E\([BL]\)[ 	].*$/,\1/
+t h
+s/^.*[ 	]-E\([BL]\)$/,\1/
+t h
+d
+: h
+h

binutils-CVE-2025-11083.patch

@@ -16,8 +16,8 @@ Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
  bfd/elfcode.h | 14 +++++++++-----
  1 file changed, 9 insertions(+), 5 deletions(-)
 
---- binutils-with-gold-2.44.orig/bfd/elfcode.h	2025-11-26 15:41:49.547812496 +0000
-+++ binutils-with-gold-2.44/bfd/elfcode.h	2025-11-26 15:43:23.570202970 +0000
+--- binutils-with-gold-2.44.orig/bfd/elfcode.h	2025-11-25 13:08:19.115156918 +0000
++++ binutils-with-gold-2.44/bfd/elfcode.h	2025-11-25 13:10:34.050519670 +0000
 @@ -311,7 +311,7 @@ elf_swap_ehdr_out (bfd *abfd,
  /* Translate an ELF section header table entry in external format into an
     ELF section header table entry in internal format.  */

binutils.spec

@@ -5,8 +5,11 @@
 %endif
 
 %global gts_ver 15
+%global gts_next  %(v="%{gts_ver}"; echo $((++v)))
+
 %{?scl_package:%global scl gcc-toolset-%{gts_ver}}
 %global scl_prefix gcc-toolset-%{gts_ver}-
+
 %if %have_scl_utils
 BuildRequires: scl-utils-build
 %else
@@ -24,7 +27,7 @@ Name: %{?scl_prefix}binutils
 # The variable %%{source} (see below) should be set to indicate which of these
 # origins is being used.
 Version: 2.44
-Release: 5%{?dist}
+Release: 8%{?dist}
 License: GPL-3.0-or-later AND (GPL-3.0-or-later WITH Bison-exception-2.2) AND (LGPL-2.0-or-later WITH GCC-exception-2.0) AND BSD-3-Clause AND GFDL-1.3-or-later AND GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.0-or-later
 URL: https://sourceware.org/binutils
 
@@ -388,16 +391,15 @@ BuildRequires: clang compiler-rt
 %define gcc_package %{?scl_prefix}gcc
 %define gxx_package %{?scl_prefix}gcc-c++
 
-# FIXME: gcc-annobin.so is not currently built...
-%undefine _annotated_build
+%define gcc_for_binutils %{_scl_root}/usr/bin/gcc
+%define gxx_for_binutils %{_scl_root}/usr/bin/g++
 
 %if 0%{rhel} < 9
 BuildRequires: %{?scl_prefix}annobin-plugin-gcc
+%else
+BuildRequires: %{?scl_prefix}gcc-plugin-annobin
 %endif
 
-%define gcc_for_binutils %{_scl_root}/usr/bin/gcc
-%define gxx_for_binutils %{_scl_root}/usr/bin/g++
-
 %endif
 
 BuildRequires: %{gcc_package}
@@ -480,7 +482,10 @@ BuildRequires: xxhash-devel
 
 %if %have_scl_utils
 %{?scl:Requires:%scl_runtime}
+%else
+Requires:  (%{?scl_prefix}runtime >= %{gts_ver} with %{?scl_prefix}runtime < %{gts_next})
 %endif
+
 %define alternatives_cmd     %{!?scl:%{_sbindir}}%{?scl:%{_root_sbindir}}/alternatives
 %define alternatives_cmdline %{alternatives_cmd}%{?scl: --altdir %{_sysconfdir}/alternatives --admindir %{_scl_root}/var/lib/alternatives}
 
@@ -1576,17 +1581,27 @@ exit 0
 
 #----------------------------------------------------------------------------
 %changelog
-* Wed Nov 26 2025 Nick Clifton  <nickc@redhat.com> - 2.44-5
-- Fix a potential illegal memory access when linking a corrupt input file.  (RHEL-130670)
+* Tue Nov 25 2025 Nick Clifton  <nickc@redhat.com> - 2.44-8
+- Fix a potential illegal memory access when linking a corrupt input file.  (RHEL-130615)
 
-* Mon Sep 08 2025 Nick Clifton  <nickc@redhat.com> - 2.44-4
-- Disable bootstrapping.  (RHEL-112561)
+* Mon Aug 11 2025 Nick Clifton  <nickc@redhat.com> - 2.44-7
+- Remove uneeded glibc/powerpc patch.  (RHEL-100160)
+
+* Wed Aug 06 2025 Nick Clifton  <nickc@redhat.com> - 2.44-6
+- Rebuild with glibc fixed for CVE-2025-5702.  (RHEL-100160)
+
+* Tue Jul 22 2025 Nick Clifton  <nickc@redhat.com> - 2.44-5
+- Disable bootstrapping.  (RHEL-94763)
+
+* Tue Jun 24 2025 Nick Clifton  <nickc@redhat.com> - 2.44-4
+- Use the new gcc-toolset-15-runtime package.  (RHEL-94763)
+- Add in the temporary fix for ppc64 gcc/glibc generating bad code.  (RHEL-49348)
 
 * Mon May 12 2025 Siddhesh Poyarekar <siddhesh@redhat.com> - 2.44-3
 - Avoid using SCL for c10s.
 
-* Wed May 07 2025 Siddhesh Poyarekar <siddhesh@redhat.com> - 2.44-2
-- Use system alternatives even for bootstrap.
+* Thu May 08 2025 Nick Clifton  <nickc@redhat.com> - 2.44-2
+- Switch back to using SCL macros.
 
-* Wed Apr 09 2025 Nick Clifton  <nickc@redhat.com> - 2.44-1
-- Initial commit: Import Fedora 42 binutils to GTS-15.
+* Tue May 06 2025 Nick Clifton  <nickc@redhat.com> - 2.44-1
+- Initial commit: Import Fedora 42 binutils to GTS-15.  (RHELPLAN-172023) (RHEL-81745)

gating.yaml

@@ -7,7 +7,7 @@ rules:
   - !PassingTestCaseRule {test_case_name: baseos-qe.koji-build.scratch-build.validation}
 --- !Policy
 product_versions:
-  - rhel-9
+  - rhel-10
 decision_context: osci_compose_gate
 rules:
   - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.gate-build-fast-lane.functional}

sources

@@ -1,2 +1 @@
 SHA512 (binutils-with-gold-2.44.tar.xz) = 1d8688f1b6f1bc64cfd1f82e3af05b8ace1d709d4fa819acb4d12d74e1b69b4314d98fb4281dacc9b5fa51ff7370d0249f540ec016fd137aa701502d72426301
-SHA512 (binutils-2.19.50.0.1-output-format.sed) = 2f8686b0c8af13c98cda056824c2820416f6e2d003f70b78ccf5314525b9ee3684d421dfa83e638a2d42d06ea4d4bdaf5226b64d6ec26f7ff59c44ffb2a23dd2