Fix a seg-fault that can occur when parsing corrupt DWARF2 information, corrupt ELF files and corrupt PE files.

Resolves: #1573359
Resolves: #1574700
Resolves: #1573365
Resolves: #1551786
Resolves: #1546624
Resolves: #1543245
Resolves: #1539888

binutils-2.28-ignore-gold-duplicates.patch

@@ -0,0 +1,14 @@
+diff -rup binutils.orig/ld/ldmain.c binutils-2.28/ld/ldmain.c
+--- binutils.orig/ld/ldmain.c	2017-06-09 09:08:26.954016429 +0100
++++ binutils-2.28/ld/ldmain.c	2017-06-09 09:09:11.307490976 +0100
+@@ -923,6 +923,10 @@ multiple_definition (struct bfd_link_inf
+       obfd = h->u.def.section->owner;
+       break;
+     case bfd_link_hash_indirect:
++      /* PR 21074: The GOLD linker can produce multiple indirect
++	 refences to the same symbol.  These can be ignored.  */
++      if (bfd_is_ind_section (nsec))
++	return;
+       osec = bfd_ind_section_ptr;
+       oval = 0;
+       obfd = NULL;

binutils-CVE-2018-10372.patch

@@ -0,0 +1,22 @@
+--- binutils.orig/binutils/dwarf.c	2018-07-11 11:45:09.971024884 +0100
++++ binutils-2.29/binutils/dwarf.c	2018-07-11 14:16:38.417025086 +0100
+@@ -8509,7 +8509,18 @@ process_cu_tu_index (struct dwarf_sectio
+ 		}
+ 
+ 	      if (!do_display)
+-		memcpy (&this_set[row - 1].signature, ph, sizeof (uint64_t));
++		{
++		  size_t num_copy = sizeof (uint64_t);
++
++		  /* PR 23064: Beware of buffer overflow.  */
++		  if (ph + num_copy < limit)
++		    memcpy (&this_set[row - 1].signature, ph, num_copy);
++		  else
++		    {
++		      warn (_("Signature (%p) extends beyond end of space in section\n"), ph);
++		      return 0;
++		    }
++		}
+ 
+ 	      prow = poffsets + (row - 1) * ncols * 4;
+ 	      /* PR 17531: file: b8ce60a8.  */

binutils-CVE-2018-10373.patch

@@ -0,0 +1,11 @@
+--- binutils.orig/bfd/dwarf2.c	2018-07-11 14:28:44.557235916 +0100
++++ binutils-2.29.1/bfd/dwarf2.c	2018-07-11 14:38:37.611875790 +0100
+@@ -1593,7 +1593,7 @@ concat_filename (struct line_info_table
+ {
+   char *filename;
+ 
+-  if (file - 1 >= table->num_files)
++  if (table == NULL || file - 1 >= table->num_files)
+     {
+       /* FILE == 0 means unknown.  */
+       if (file)

binutils-CVE-2018-10535.patch

@@ -0,0 +1,19 @@
+--- binutils.orig/bfd/peXXigen.c	2018-07-11 14:28:44.937231840 +0100
++++ binutils-2.29.1/bfd/peXXigen.c	2018-07-11 14:29:27.861771394 +0100
+@@ -2992,6 +2992,16 @@ _bfd_XX_bfd_copy_private_bfd_data_common
+ 	      return FALSE;
+ 	    }
+ 
++	  /* PR 23110.  */
++	  else if (ope->pe_opthdr.DataDirectory[PE_DEBUG_DATA].Size < 0)
++	    {
++	      /* xgettext:c-format */
++	      _bfd_error_handler
++		(_("%pB: Data Directory size (%#lx) is negative"),
++		 obfd, ope->pe_opthdr.DataDirectory[PE_DEBUG_DATA].Size);
++	      return FALSE;
++	    }
++
+           for (i = 0; i < ope->pe_opthdr.DataDirectory[PE_DEBUG_DATA].Size
+ 		 / sizeof (struct external_IMAGE_DEBUG_DIRECTORY); i++)
+             {

binutils-CVE-2018-13033.patch

@@ -0,0 +1,18 @@
+--- binutils.orig/bfd/elf-attrs.c	2018-07-05 11:14:28.914603764 +0100
++++ binutils-2.29.1/bfd/elf-attrs.c	2018-07-05 11:14:58.249275811 +0100
+@@ -438,6 +438,15 @@ _bfd_elf_parse_attributes (bfd *abfd, El
+   /* PR 17512: file: 2844a11d.  */
+   if (hdr->sh_size == 0)
+     return;
++  if (hdr->sh_size > bfd_get_file_size (abfd))
++    {
++      /* xgettext:c-format */
++      _bfd_error_handler (_("%pB: error: attribute section '%pA' too big: %#llx"),
++			  abfd, hdr->bfd_section, (long long) hdr->sh_size);
++      bfd_set_error (bfd_error_invalid_operation);
++      return;
++    }
++
+   contents = (bfd_byte *) bfd_malloc (hdr->sh_size + 1);
+   if (!contents)
+     return;

binutils-CVE-2018-6323.patch

@@ -0,0 +1,20 @@
+--- binutils.orig/bfd/elfcode.h	2018-07-11 14:28:45.439226455 +0100
++++ binutils-2.29.1/bfd/elfcode.h	2018-07-11 15:23:54.982819379 +0100
+@@ -680,7 +680,7 @@ elf_object_p (bfd *abfd)
+       if (i_ehdrp->e_shnum > ((bfd_size_type) -1) / sizeof (*i_shdrp))
+ 	goto got_wrong_format_error;
+ #endif
+-      amt = sizeof (*i_shdrp) * i_ehdrp->e_shnum;
++      amt = sizeof (*i_shdrp) * (bfd_size_type) i_ehdrp->e_shnum;
+       i_shdrp = (Elf_Internal_Shdr *) bfd_alloc (abfd, amt);
+       if (!i_shdrp)
+ 	goto got_no_match;
+@@ -776,7 +776,7 @@ elf_object_p (bfd *abfd)
+       if (i_ehdrp->e_phnum > ((bfd_size_type) -1) / sizeof (*i_phdr))
+ 	goto got_wrong_format_error;
+ #endif
+-      amt = i_ehdrp->e_phnum * sizeof (*i_phdr);
++      amt = (bfd_size_type) i_ehdrp->e_phnum * sizeof (*i_phdr);
+       elf_tdata (abfd)->phdr = (Elf_Internal_Phdr *) bfd_alloc (abfd, amt);
+       if (elf_tdata (abfd)->phdr == NULL)
+ 	goto got_no_match;

binutils-CVE-2018-6759.patch

@@ -0,0 +1,68 @@
+--- binutils.orig/bfd/opncls.c	2018-07-11 14:28:44.690234489 +0100
++++ binutils-2.29.1/bfd/opncls.c	2018-07-11 15:14:54.576580916 +0100
+@@ -1179,6 +1179,7 @@ bfd_get_debug_link_info_1 (bfd *abfd, vo
+   bfd_byte *contents;
+   unsigned int crc_offset;
+   char *name;
++  bfd_size_type size;
+ 
+   BFD_ASSERT (abfd);
+   BFD_ASSERT (crc32_out);
+@@ -1188,6 +1189,12 @@ bfd_get_debug_link_info_1 (bfd *abfd, vo
+   if (sect == NULL)
+     return NULL;
+ 
++  size = bfd_get_section_size (sect);
++
++  /* PR 22794: Make sure that the section has a reasonable size.  */
++  if (size < 8 || size >= bfd_get_size (abfd))
++    return NULL;
++
+   if (!bfd_malloc_and_get_section (abfd, sect, &contents))
+     {
+       if (contents != NULL)
+@@ -1198,9 +1205,9 @@ bfd_get_debug_link_info_1 (bfd *abfd, vo
+   /* CRC value is stored after the filename, aligned up to 4 bytes.  */
+   name = (char *) contents;
+   /* PR 17597: avoid reading off the end of the buffer.  */
+-  crc_offset = strnlen (name, bfd_get_section_size (sect)) + 1;
++  crc_offset = strnlen (name, size) + 1;
+   crc_offset = (crc_offset + 3) & ~3;
+-  if (crc_offset >= bfd_get_section_size (sect))
++  if (crc_offset >= size)
+     return NULL;
+ 
+   *crc32 = bfd_get_32 (abfd, contents + crc_offset);
+@@ -1261,6 +1268,7 @@ bfd_get_alt_debug_link_info (bfd * abfd,
+   bfd_byte *contents;
+   unsigned int buildid_offset;
+   char *name;
++  bfd_size_type size;
+ 
+   BFD_ASSERT (abfd);
+   BFD_ASSERT (buildid_len);
+@@ -1271,6 +1279,10 @@ bfd_get_alt_debug_link_info (bfd * abfd,
+   if (sect == NULL)
+     return NULL;
+ 
++  size = bfd_get_section_size (sect);
++  if (size < 8 || size >= bfd_get_size (abfd))
++    return NULL;
++
+   if (!bfd_malloc_and_get_section (abfd, sect, & contents))
+     {
+       if (contents != NULL)
+@@ -1280,11 +1292,11 @@ bfd_get_alt_debug_link_info (bfd * abfd,
+ 
+   /* BuildID value is stored after the filename.  */
+   name = (char *) contents;
+-  buildid_offset = strnlen (name, bfd_get_section_size (sect)) + 1;
++  buildid_offset = strnlen (name, size) + 1;
+   if (buildid_offset >= bfd_get_section_size (sect))
+     return NULL;
+ 
+-  *buildid_len = bfd_get_section_size (sect) - buildid_offset;
++  *buildid_len = size - buildid_offset;
+   *buildid_out = bfd_malloc (*buildid_len);
+   memcpy (*buildid_out, contents + buildid_offset, *buildid_len);
+ 

binutils-CVE-2018-7208.patch

@@ -0,0 +1,12 @@
+--- binutils.orig/bfd/coffgen.c	2018-07-11 11:45:09.490030070 +0100
++++ binutils-2.29/bfd/coffgen.c	2018-07-11 15:02:48.863331411 +0100
+@@ -1555,7 +1555,8 @@ coff_pointerize_aux (bfd *abfd,
+     }
+   /* A negative tagndx is meaningless, but the SCO 3.2v4 cc can
+      generate one, so we must be careful to ignore it.  */
+-  if (auxent->u.auxent.x_sym.x_tagndx.l > 0)
++  if ((unsigned long) auxent->u.auxent.x_sym.x_tagndx.l
++      < obj_raw_syment_count (abfd))
+     {
+       auxent->u.auxent.x_sym.x_tagndx.p =
+ 	table_base + auxent->u.auxent.x_sym.x_tagndx.l;

binutils-CVE-2018-7568.patch

@@ -0,0 +1,39 @@
+--- binutils.orig/bfd/dwarf1.c	2018-07-11 11:45:09.482030157 +0100
++++ binutils-2.29/bfd/dwarf1.c	2018-07-11 11:48:19.564980423 +0100
+@@ -208,6 +208,7 @@ parse_die (bfd *             abfd,
+   /* Then the attributes.  */
+   while (xptr < (this_die + aDieInfo->length))
+     {
++      unsigned int   block_len;
+       unsigned short attr;
+ 
+       /* Parse the attribute based on its form.  This section
+@@ -243,10 +244,26 @@ parse_die (bfd *             abfd,
+ 	  xptr += 4;
+ 	  break;
+ 	case FORM_BLOCK2:
+-	  xptr += 2 + bfd_get_16 (abfd, (bfd_byte *) xptr);
++ 	  if (xptr + 2 <= aDiePtrEnd)
++	    {
++	      block_len = bfd_get_16 (abfd, xptr);
++	      if (xptr + block_len > aDiePtrEnd
++		  || xptr + block_len < xptr)
++		return FALSE;
++	      xptr += block_len;
++	    }
++ 	  xptr += 2;
+ 	  break;
+ 	case FORM_BLOCK4:
+-	  xptr += 4 + bfd_get_32 (abfd, (bfd_byte *) xptr);
++	  if (xptr + 4 <= aDiePtrEnd)
++	    {
++	      block_len = bfd_get_32 (abfd, xptr);
++	      if (xptr + block_len > aDiePtrEnd
++		  || xptr + block_len < xptr)
++		return FALSE;
++	      xptr += block_len;
++	    }
++ 	  xptr += 4;
+ 	  break;
+ 	case FORM_STRING:
+ 	  if (attr == AT_name)

binutils-CVE-2018-7569.patch

@@ -0,0 +1,75 @@
+--- binutils.orig/bfd/dwarf2.c	2018-07-11 11:45:09.491030059 +0100
++++ binutils-2.29/bfd/dwarf2.c	2018-07-11 12:16:12.975943400 +0100
+@@ -626,14 +626,24 @@ read_8_bytes (bfd *abfd, bfd_byte *buf,
+ }
+ 
+ static bfd_byte *
+-read_n_bytes (bfd *abfd ATTRIBUTE_UNUSED,
+-	      bfd_byte *buf,
+-	      bfd_byte *end,
+-	      unsigned int size ATTRIBUTE_UNUSED)
+-{
+-  if (buf + size > end)
+-    return NULL;
+-  return buf;
++read_n_bytes (bfd_byte *           buf,
++	      bfd_byte *           end,
++	      struct dwarf_block * block)
++{
++  unsigned int  size = block->size;
++  bfd_byte *    block_end = buf + size;
++
++  if (block_end > end || block_end < buf)
++    {
++      block->data = NULL;
++      block->size = 0;
++      return end;
++    }
++  else
++    {
++      block->data = buf;
++      return block_end;
++    }
+ }
+ 
+ /* Scans a NUL terminated string starting at BUF, returning a pointer to it.
+@@ -1131,8 +1141,7 @@ read_attribute_value (struct attribute *
+ 	return NULL;
+       blk->size = read_2_bytes (abfd, info_ptr, info_ptr_end);
+       info_ptr += 2;
+-      blk->data = read_n_bytes (abfd, info_ptr, info_ptr_end, blk->size);
+-      info_ptr += blk->size;
++      info_ptr = read_n_bytes (info_ptr, info_ptr_end, blk);
+       attr->u.blk = blk;
+       break;
+     case DW_FORM_block4:
+@@ -1142,8 +1151,7 @@ read_attribute_value (struct attribute *
+ 	return NULL;
+       blk->size = read_4_bytes (abfd, info_ptr, info_ptr_end);
+       info_ptr += 4;
+-      blk->data = read_n_bytes (abfd, info_ptr, info_ptr_end, blk->size);
+-      info_ptr += blk->size;
++      info_ptr = read_n_bytes (info_ptr, info_ptr_end, blk);
+       attr->u.blk = blk;
+       break;
+     case DW_FORM_data2:
+@@ -1183,8 +1191,7 @@ read_attribute_value (struct attribute *
+       blk->size = _bfd_safe_read_leb128 (abfd, info_ptr, &bytes_read,
+ 					 FALSE, info_ptr_end);
+       info_ptr += bytes_read;
+-      blk->data = read_n_bytes (abfd, info_ptr, info_ptr_end, blk->size);
+-      info_ptr += blk->size;
++      info_ptr = read_n_bytes (info_ptr, info_ptr_end, blk);
+       attr->u.blk = blk;
+       break;
+     case DW_FORM_block1:
+@@ -1194,8 +1201,7 @@ read_attribute_value (struct attribute *
+ 	return NULL;
+       blk->size = read_1_byte (abfd, info_ptr, info_ptr_end);
+       info_ptr += 1;
+-      blk->data = read_n_bytes (abfd, info_ptr, info_ptr_end, blk->size);
+-      info_ptr += blk->size;
++      info_ptr = read_n_bytes (info_ptr, info_ptr_end, blk);
+       attr->u.blk = blk;
+       break;
+     case DW_FORM_data1:

binutils-CVE-2018-7643.patch

@@ -0,0 +1,16 @@
+--- binutils.orig/binutils/dwarf.c	2018-04-27 09:22:07.402864408 +0100
++++ binutils-2.30/binutils/dwarf.c	2018-04-27 09:24:26.794235786 +0100
+@@ -6810,6 +6810,13 @@ display_debug_ranges (struct dwarf_secti
+ 	  continue;
+ 	}
+ 
++      if (next < section_begin || next >= finish)
++	{
++	  warn (_("Corrupt offset (%#8.8lx) in range entry %u\n"),
++		(unsigned long) offset, i);
++	  continue;
++	}
++
+       if (dwarf_check != 0 && i > 0)
+ 	{
+ 	  if (start < next)

binutils-debug-section-marking.patch

@@ -0,0 +1,39 @@
+--- binutils.orig/bfd/elflink.c	2018-03-14 10:14:49.729271271 +0000
++++ binutils-2.30/bfd/elflink.c	2018-03-14 10:15:15.748967793 +0000
+@@ -12785,7 +12785,7 @@ _bfd_elf_gc_mark_hook (asection *sec,
+   return NULL;
+ }
+ 
+-/* Return the global debug definition section.  */
++/* Return the debug definition section.  */
+ 
+ static asection *
+ elf_gc_mark_debug_section (asection *sec ATTRIBUTE_UNUSED,
+@@ -12794,11 +12794,22 @@ elf_gc_mark_debug_section (asection *sec
+ 			   struct elf_link_hash_entry *h,
+ 			   Elf_Internal_Sym *sym ATTRIBUTE_UNUSED)
+ {
+-  if (h != NULL
+-      && (h->root.type == bfd_link_hash_defined
+-	  || h->root.type == bfd_link_hash_defweak)
+-      && (h->root.u.def.section->flags & SEC_DEBUGGING) != 0)
+-    return h->root.u.def.section;
++  if (h != NULL)
++    {
++      /* Return the global debug definition section.  */
++      if ((h->root.type == bfd_link_hash_defined
++	   || h->root.type == bfd_link_hash_defweak)
++	  && (h->root.u.def.section->flags & SEC_DEBUGGING) != 0)
++	return h->root.u.def.section;
++    }
++  else
++    {
++      /* Return the local debug definition section.  */
++      asection *isec = bfd_section_from_elf_index (sec->owner,
++						   sym->st_shndx);
++      if ((isec->flags & SEC_DEBUGGING) != 0)
++	return isec;
++    }
+ 
+   return NULL;
+ }

binutils-ifunc-relocs-in-notes.patch

@@ -0,0 +1,139 @@
+diff -rup binutils.orig/bfd/elf32-i386.c binutils-2.29.1/bfd/elf32-i386.c
+--- binutils.orig/bfd/elf32-i386.c	2018-03-09 15:55:56.812856843 +0000
++++ binutils-2.29.1/bfd/elf32-i386.c	2018-03-09 16:00:45.104464000 +0000
+@@ -4080,6 +4080,10 @@ elf_i386_relocate_section (bfd *output_b
+ 
+ 	  if ((input_section->flags & SEC_ALLOC) == 0)
+ 	    {
++	      /* If this is a SHT_NOTE section without SHF_ALLOC, treat
++	         STT_GNU_IFUNC symbol as STT_FUNC.  */
++	      if (elf_section_type (input_section) == SHT_NOTE)
++		goto skip_ifunc;
+ 	      /* Dynamic relocs are not propagated for SEC_DEBUGGING
+ 		 sections because such sections are not SEC_ALLOC and
+ 		 thus ld.so will not process them.  */
+@@ -4301,6 +4305,7 @@ do_ifunc_pointer:
+ 	    }
+ 	}
+ 
++    skip_ifunc:
+       resolved_to_zero = (eh != NULL
+ 			  && UNDEFINED_WEAK_RESOLVED_TO_ZERO (info,
+ 							      eh->has_got_reloc,
+diff -rup binutils.orig/bfd/elf32-s390.c binutils-2.29.1/bfd/elf32-s390.c
+--- binutils.orig/bfd/elf32-s390.c	2018-03-09 15:55:56.827856667 +0000
++++ binutils-2.29.1/bfd/elf32-s390.c	2018-03-09 16:00:37.519553849 +0000
+@@ -2770,6 +2770,9 @@ elf_s390_relocate_section (bfd *output_b
+ 	case R_390_8:
+ 	case R_390_16:
+ 	case R_390_32:
++	  if ((input_section->flags & SEC_ALLOC) == 0)
++	    break;
++
+ 	  if (h != NULL
+ 	      && s390_is_ifunc_symbol_p (h)
+ 	      && h->def_regular)
+@@ -2831,9 +2834,6 @@ elf_s390_relocate_section (bfd *output_b
+ 		}
+ 	    }
+ 
+-	  if ((input_section->flags & SEC_ALLOC) == 0)
+-	    break;
+-
+ 	  if ((bfd_link_pic (info)
+ 	       && (h == NULL
+ 		   || ELF_ST_VISIBILITY (h->other) == STV_DEFAULT
+diff -rup binutils.orig/bfd/elf64-s390.c binutils-2.29.1/bfd/elf64-s390.c
+--- binutils.orig/bfd/elf64-s390.c	2018-03-09 15:55:56.812856843 +0000
++++ binutils-2.29.1/bfd/elf64-s390.c	2018-03-09 16:00:29.038654304 +0000
+@@ -2739,6 +2739,9 @@ elf_s390_relocate_section (bfd *output_b
+ 	case R_390_32:
+ 	case R_390_64:
+ 
++	  if ((input_section->flags & SEC_ALLOC) == 0)
++	    break;
++
+ 	  if (h != NULL
+ 	      && s390_is_ifunc_symbol_p (h)
+ 	      && h->def_regular)
+@@ -2801,9 +2804,6 @@ elf_s390_relocate_section (bfd *output_b
+ 		}
+ 	    }
+ 
+-	  if ((input_section->flags & SEC_ALLOC) == 0)
+-	    break;
+-
+ 	  if ((bfd_link_pic (info)
+ 	       && (h == NULL
+ 		   || (ELF_ST_VISIBILITY (h->other) == STV_DEFAULT
+diff -rup binutils.orig/bfd/elf64-x86-64.c binutils-2.29.1/bfd/elf64-x86-64.c
+--- binutils.orig/bfd/elf64-x86-64.c	2018-03-09 15:55:56.826856678 +0000
++++ binutils-2.29.1/bfd/elf64-x86-64.c	2018-03-09 16:00:20.798751915 +0000
+@@ -4409,6 +4409,10 @@ elf_x86_64_relocate_section (bfd *output
+ 
+ 	  if ((input_section->flags & SEC_ALLOC) == 0)
+ 	    {
++	      /* If this is a SHT_NOTE section without SHF_ALLOC, treat
++	         STT_GNU_IFUNC symbol as STT_FUNC.  */
++	      if (elf_section_type (input_section) == SHT_NOTE)
++		goto skip_ifunc;
+ 	      /* Dynamic relocs are not propagated for SEC_DEBUGGING
+ 		 sections because such sections are not SEC_ALLOC and
+ 		 thus ld.so will not process them.  */
+@@ -4634,6 +4638,7 @@ do_ifunc_pointer:
+ 	    }
+ 	}
+ 
++    skip_ifunc:
+       resolved_to_zero = (eh != NULL
+ 			  && UNDEFINED_WEAK_RESOLVED_TO_ZERO (info,
+ 							      eh->has_got_reloc,
+diff -rup binutils.orig/bfd/elfnn-aarch64.c binutils-2.29.1/bfd/elfnn-aarch64.c
+--- binutils.orig/bfd/elfnn-aarch64.c	2018-03-09 15:55:56.821856737 +0000
++++ binutils-2.29.1/bfd/elfnn-aarch64.c	2018-03-09 16:00:13.181842141 +0000
+@@ -4984,6 +4984,11 @@ elfNN_aarch64_final_link_relocate (reloc
+ 
+       if ((input_section->flags & SEC_ALLOC) == 0)
+ 	{
++	  /* If this is a SHT_NOTE section without SHF_ALLOC, treat
++	     STT_GNU_IFUNC symbol as STT_FUNC.  */
++	  if (elf_section_type (input_section) == SHT_NOTE)
++	    goto skip_ifunc;
++
+ 	  /* Dynamic relocs are not propagated for SEC_DEBUGGING
+ 	     sections because such sections are not SEC_ALLOC and
+ 	     thus ld.so will not process them.  */
+@@ -5177,6 +5182,7 @@ bad_ifunc_reloc:
+ 	}
+     }
+ 
++ skip_ifunc:
+   resolved_to_zero = (h != NULL
+ 		      && UNDEFWEAK_NO_DYNAMIC_RELOC (info, h));
+ 
+diff -rup binutils.orig/bfd/elfxx-sparc.c binutils-2.29.1/bfd/elfxx-sparc.c
+--- binutils.orig/bfd/elfxx-sparc.c	2018-03-09 15:55:56.822856726 +0000
++++ binutils-2.29.1/bfd/elfxx-sparc.c	2018-03-09 16:00:02.604967430 +0000
+@@ -3203,7 +3203,13 @@ _bfd_sparc_elf_relocate_section (bfd *ou
+ 
+ 	  if ((input_section->flags & SEC_ALLOC) == 0
+ 	      || h->plt.offset == (bfd_vma) -1)
+-	    abort ();
++	    {
++	      /* If this is a SHT_NOTE section without SHF_ALLOC, treat
++	         STT_GNU_IFUNC symbol as STT_FUNC.  */
++	      if (elf_section_type (input_section) == SHT_NOTE)
++		goto skip_ifunc;
++	      abort ();
++	    }
+ 
+ 	  plt_sec = htab->elf.splt;
+ 	  if (! plt_sec)
+@@ -3307,6 +3313,7 @@ _bfd_sparc_elf_relocate_section (bfd *ou
+ 	    }
+ 	}
+ 
++    skip_ifunc:
+       eh = (struct _bfd_sparc_elf_link_hash_entry *) h;
+       resolved_to_zero = (eh != NULL
+                           && UNDEFINED_WEAK_RESOLVED_TO_ZERO (info, eh));

binutils-speed-up-objdump.patch

@@ -0,0 +1,97 @@
+--- binutils.orig/binutils/objdump.c	2018-03-05 17:04:19.901619738 +0000
++++ binutils-2.29/binutils/objdump.c	2018-03-05 17:10:08.334643096 +0000
+@@ -664,9 +664,7 @@ slurp_dynamic_symtab (bfd *abfd)
+ static bfd_boolean
+ is_significant_symbol_name (const char * name)
+ {
+-  return strcmp (name, ".plt") == 0
+-    ||   strcmp (name, ".got") == 0
+-    ||   strcmp (name, ".plt.got") == 0;
++  return strncmp (name, ".plt", 4) == 0 || strcmp (name, ".got") == 0;
+ }
+ 
+ /* Filter out (in place) symbols that are useless for disassembly.
+@@ -937,6 +935,7 @@ find_symbol_for_address (bfd_vma vma,
+   asection *sec;
+   unsigned int opb;
+   bfd_boolean want_section;
++  long rel_count;
+ 
+   if (sorted_symcount < 1)
+     return NULL;
+@@ -1065,33 +1064,59 @@ find_symbol_for_address (bfd_vma vma,
+      and we have dynamic relocations available, then we can produce
+      a better result by matching a relocation to the address and
+      using the symbol associated with that relocation.  */
++  rel_count = aux->dynrelcount;
+   if (!want_section
+-      && aux->dynrelbuf != NULL
+       && sorted_syms[thisplace]->value != vma
++      && rel_count > 0
++      && aux->dynrelbuf != NULL
++      && aux->dynrelbuf[0]->address <= vma
++      && aux->dynrelbuf[rel_count - 1]->address >= vma
+       /* If we have matched a synthetic symbol, then stick with that.  */
+       && (sorted_syms[thisplace]->flags & BSF_SYNTHETIC) == 0)
+     {
+-      long        rel_count;
+-      arelent **  rel_pp;
++      arelent **  rel_low;
++      arelent **  rel_high;
+ 
+-      for (rel_count = aux->dynrelcount, rel_pp = aux->dynrelbuf;
+-	   rel_count--;)
++      rel_low = aux->dynrelbuf;
++      rel_high = rel_low + rel_count - 1;
++      while (rel_low <= rel_high)
+ 	{
+-	  arelent * rel = rel_pp[rel_count];
++	  arelent ** rel_mid = &rel_low[(rel_high - rel_low) / 2];
++	  arelent *  rel = *rel_mid;
+ 
+-	  if (rel->address == vma
+-	      && rel->sym_ptr_ptr != NULL
+-	      /* Absolute relocations do not provide a more helpful symbolic address.  */
+-	      && ! bfd_is_abs_section ((* rel->sym_ptr_ptr)->section))
++	  if (rel->address == vma)
+ 	    {
+-	      if (place != NULL)
+-		* place = thisplace;
+-	      return * rel->sym_ptr_ptr;
++	      /* Absolute relocations do not provide a more helpful
++	         symbolic address.  Find a non-absolute relocation
++	         with the same address.  */
++
++	      arelent **rel_vma = rel_mid;
++
++	      for (rel_mid--;
++		   rel_mid >= rel_low && rel_mid[0]->address == vma;
++		   rel_mid--)
++		rel_vma = rel_mid;
++
++	      for (; rel_vma <= rel_high && rel_vma[0]->address == vma;
++		   rel_vma++)
++		{
++		  rel = *rel_vma;
++		  if (rel->sym_ptr_ptr != NULL
++		      && ! bfd_is_abs_section ((* rel->sym_ptr_ptr)->section))
++		    {
++		      if (place != NULL)
++			* place = thisplace;
++		      return * rel->sym_ptr_ptr;
++		    }
++		}
++	      break;
+ 	    }
+ 
+-	  /* We are scanning backwards, so if we go below the target address
+-	     we have failed.  */
+-	  if (rel_pp[rel_count]->address < vma)
++	  if (vma < rel->address)
++	    rel_high = rel_mid;
++	  else if (vma >= rel_mid[1]->address)
++	    rel_low = rel_mid + 1;
++	  else
+ 	    break;
+ 	}
+     }

binutils.spec

@@ -62,7 +62,7 @@
 Summary: A GNU collection of binary utilities
 Name: %{?cross}binutils%{?_with_debug:-debug}
 Version: 2.29.1
-Release: 19%{?dist}
+Release: 27%{?dist}
 License: GPLv3+
 Group: Development/Tools
 URL: https://sourceware.org/binutils
@@ -178,6 +178,67 @@ Patch15: binutils-aarch64-pie.patch
 # Lifetime: Fixed in 2.31.  See BZ 1523457
 Patch16: binutils-ppc64-stub-creation.patch
 
+# Purpose:  Improves objdump's function for locating a symbol to match a
+#           given address, so that it uses a binary chop algorithm.
+# Lifetime: Fixed in 2.31.
+Patch17: binutils-speed-up-objdump.patch
+
+# Purpose:  Ignore duplicate indirect symbols generated by GOLD.
+# Lifetime: Permanent.
+# FIXME:    This problem needs to be resolved in the FSF sources, but the
+#           GOLD maintainers seem to be reluctant to address the issue.
+Patch18: binutils-2.28-ignore-gold-duplicates.patch
+
+# Purpose:  Treat relocs against STT_GNU_IFUNC symbols in note sections as
+#           if they were relocs against STT_FUNC symbols instead.
+# Lifetime: Fixed in 2.31.
+Patch19: binutils-ifunc-relocs-in-notes.patch
+
+# Purpose:  Do not discard debug only object files created by GCC v8's
+#           LTO wrapper.
+# Lifetime: Fixed in 2.31.
+Patch20: binutils-debug-section-marking.patch
+
+# Purpose:  Fix a potential memory exhaustion attack using corrupt ELF files.
+# Lifetime: Fixed in 2.31.
+Patch21: binutils-CVE-2018-13033.patch
+
+# Purpose:  Fix a seg-fault induced when parsing corrupt DWARF1 files.
+# Lifetime: Fixed in 2.30.
+Patch22: binutils-CVE-2018-7568.patch
+
+# Purpose:  Fix a seg-fault induced when parsing corrupt DWARF2 files.
+# Lifetime: Fixed in 2.30.
+Patch23: binutils-CVE-2018-7569.patch
+
+# Purpose:  Fix a seg-fault induced when parsing corrupt DWARF2 files.
+# Lifetime: Fixed in 2.30.
+Patch24: binutils-CVE-2018-10372.patch
+
+# Purpose:  Fix a seg-fault induced when parsing corrupt PE format files.
+# Lifetime: Fixed in 2.30.
+Patch25: binutils-CVE-2018-10535.patch
+
+# Purpose:  Fix a seg-fault induced when parsing corrupt DWARF2 information.
+# Lifetime: Fixed in 2.31.
+Patch26: binutils-CVE-2018-10373.patch
+
+# Purpose:  Fix a seg-fault induced when parsing corrupt ELF format files.
+# Lifetime: Fixed in 2.31.
+Patch27: binutils-CVE-2018-7643.patch
+
+# Purpose:  Fix a seg-fault induced when parsing corrupt PE format files.
+# Lifetime: Fixed in 2.31.
+Patch28: binutils-CVE-2018-7208.patch
+
+# Purpose:  Fix a seg-fault induced when parsing corrupt ELF format files.
+# Lifetime: Fixed in 2.31.
+Patch29: binutils-CVE-2018-7643.patch
+
+# Purpose:  Fix a seg-fault induced when parsing corrupt ELF format files.
+# Lifetime: Fixed in 2.31.
+Patch30: binutils-CVE-2018-6323.patch
+
 #----------------------------------------------------------------------------
 
 Provides: bundled(libiberty)
@@ -203,7 +264,7 @@ Provides: bundled(libiberty)
 
 Buildroot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
 
-# Perl, sed and touch are all used in the %-prep section of this spec file.
+# Perl, sed and touch are all used in the %%prep section of this spec file.
 BuildRequires: gcc, perl, sed, coreutils
 
 # Gold needs bison in order to build gold/yyscript.c.
@@ -319,6 +380,20 @@ using libelf instead of BFD.
 %patch14 -p1
 %patch15 -p1
 %patch16 -p1
+%patch17 -p1
+%patch18 -p1
+%patch19 -p1
+%patch20 -p1
+%patch21 -p1
+%patch22 -p1
+%patch23 -p1
+%patch24 -p1
+%patch25 -p1
+%patch26 -p1
+%patch27 -p1
+%patch28 -p1
+%patch29 -p1
+%patch30 -p1
 
 # We cannot run autotools as there is an exact requirement of autoconf-2.59.
 
@@ -619,7 +694,9 @@ fi
   %{_bindir}/%{?cross}ld.bfd %{ld_bfd_priority}
 %{_sbindir}/alternatives --install %{_bindir}/%{?cross}ld %{?cross}ld \
   %{_bindir}/%{?cross}ld.gold %{ld_gold_priority}
-%{_sbindir}/alternatives --auto %{?cross}ld
+if [ $1 = 0 ]; then
+  %{_sbindir}/alternatives --auto %{?cross}ld
+fi
 %endif # both ld.gold and ld.bfd
 
 %if %{isnative}
@@ -724,6 +801,37 @@ exit 0
 
 #----------------------------------------------------------------------------
 %changelog
+* Wed Jul 11 2018 Nick Clifton  <nickc@redhat.com> 2.29.1-27
+- Fix a seg-fault that can occur when parsing corrupt DWARF2 information.  (#1573359)
+- Fix a seg-fault that can occur when parsing corrupt PE files.  (#1574700)
+- Fix a seg-fault that can occur when parsing corrupt DWARF2 information.  (#1573365)
+- Fix a seg-fault that can occur when parsing corrupt ELF files.  (#1551786)
+- Fix a seg-fault that can occur when parsing corrupt PE files.  (#1546624)
+- Fix a seg-fault that can occur when parsing corrupt ELF files.  (#1543245)
+- Fix a seg-fault that can occur when parsing corrupt ELF files.  (#1539888)
+
+* Wed Jul 11 2018 Nick Clifton  <nickc@redhat.com> 2.29.1-26
+- Fix a seg-fault that can occur when parsing corrupt DWARF1 information.  (#1551772)
+- Fix a seg-fault that can occur when parsing corrupt DWARF2 information.  (#1551779)
+
+* Thu Jul 05 2018 Nick Clifton  <nickc@redhat.com> 2.29.1-25
+- Fix potential memory exhaustion when parsing corrupt ELF files.  (#1597440)
+
+* Mon Jun 18 2018 Nick Clifton  <nickc@redhat.com> 2.29.1-24
+- When installing both ld.bfd and ld.gold, do not reset the current alternative if upgrading.  (#1592069)
+
+* Wed Mar 14 2018 Nick Clifton  <nickc@redhat.com> 2.29.1-23
+- Do not discard debugobj files created by GCC v8 LTO wrapper.  (#1543912 and RHBZ 84847 and PR 20882)
+
+* Fri Mar 09 2018 Nick Clifton  <nickc@redhat.com> 2.29.1-22
+- Treat relocs against s390x IFUNC symbols in note sections as relocs against the FUNC symbol instead.  (#1553705)
+
+* Wed Mar 07 2018 Nick Clifton  <nickc@redhat.com> 2.29.1-21
+- Ignore duplicate symbols generated by GOLD.  (#1458003)
+
+* Mon Mar 05 2018 Nick Clifton  <nickc@redhat.com> 2.29.1-20
+- Speed up objdump.  (#1551540)
+
 * Mon Feb 12 2018 Nick Clifton  <nickc@redhat.com> 2.29.1-19
 - Remove comment that explained how to disable annobin.  (#1541027)