Fix an illegal memory access when parsing a corrupt ELF file.

Resolves: #1950481

binutils-2.29-filename-in-error-messages.patch

@@ -121,3 +121,25 @@
  
    free (ba_cache.strtab);
    ba_cache.strtab = NULL;
+--- binutils.orig/binutils/readelf.c	2021-01-07 12:59:35.802994842 +0000
++++ binutils-2.35.1/binutils/readelf.c	2021-01-07 13:02:36.591754005 +0000
+@@ -20818,7 +20818,8 @@ process_file (char * file_name)
+  done:
+   if (filedata)
+     {
+-      fclose (filedata->handle);
++      if (filedata->handle != NULL)
++	fclose (filedata->handle);
+       free (filedata->section_headers);
+       free (filedata->program_headers);
+       free (filedata->string_table);
+--- binutils.orig/binutils/readelf.c	2021-01-08 17:01:23.573093204 +0000
++++ binutils-2.35.1/binutils/readelf.c	2021-01-08 17:02:23.095677242 +0000
+@@ -20787,7 +20787,6 @@ process_file (char * file_name)
+   if (fread (armag, SARMAG, 1, filedata->handle) != 1)
+     {
+       error (_("Failed to read file's magic number\n"));
+-      fclose (filedata->handle);
+       goto done;
+     }
+ 

binutils-CVE-2020-35448.patch

@@ -0,0 +1,53 @@
+diff -rup binutils.orig/bfd/elf.c binutils-2.35/bfd/elf.c
+--- binutils.orig/bfd/elf.c	2021-04-19 10:49:21.757290990 +0100
++++ binutils-2.35/bfd/elf.c	2021-04-19 10:50:28.309839285 +0100
+@@ -12534,7 +12534,9 @@ _bfd_elf_slurp_secondary_reloc_section (
+       Elf_Internal_Shdr * hdr = & elf_section_data (relsec)->this_hdr;
+ 
+       if (hdr->sh_type == SHT_SECONDARY_RELOC
+-	  && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx)
++	  && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx
++	  && (hdr->sh_entsize == ebd->s->sizeof_rel
++	      || hdr->sh_entsize == ebd->s->sizeof_rela))
+ 	{
+ 	  bfd_byte * native_relocs;
+ 	  bfd_byte * native_reloc;
+diff -rup binutils.orig/bfd/elfcode.h binutils-2.35/bfd/elfcode.h
+--- binutils.orig/bfd/elfcode.h	2021-04-19 10:49:21.767290922 +0100
++++ binutils-2.35/bfd/elfcode.h	2021-04-19 10:52:22.196066303 +0100
+@@ -568,7 +568,7 @@ elf_object_p (bfd *abfd)
+ 
+   /* If this is a relocatable file and there is no section header
+      table, then we're hosed.  */
+-  if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_type == ET_REL)
++  if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_type == ET_REL)
+     goto got_wrong_format_error;
+ 
+   /* As a simple sanity check, verify that what BFD thinks is the
+@@ -578,7 +578,7 @@ elf_object_p (bfd *abfd)
+     goto got_wrong_format_error;
+ 
+   /* Further sanity check.  */
+-  if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_shnum != 0)
++  if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_shnum != 0)
+     goto got_wrong_format_error;
+ 
+   ebd = get_elf_backend_data (abfd);
+@@ -615,7 +615,7 @@ elf_object_p (bfd *abfd)
+       && ebd->elf_osabi != ELFOSABI_NONE)
+     goto got_wrong_format_error;
+ 
+-  if (i_ehdrp->e_shoff != 0)
++  if (i_ehdrp->e_shoff >= sizeof (x_ehdr))
+     {
+       file_ptr where = (file_ptr) i_ehdrp->e_shoff;
+ 
+@@ -807,7 +807,7 @@ elf_object_p (bfd *abfd)
+ 	}
+     }
+ 
+-  if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff != 0)
++  if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff >= sizeof (x_ehdr))
+     {
+       unsigned int num_sec;
+ 

binutils-CVE-2021-20294.patch

@@ -0,0 +1,14 @@
+--- binutils.orig/binutils/readelf.c	2021-03-26 12:46:41.494356890 +0000
++++ binutils-2.35/binutils/readelf.c	2021-03-26 12:48:36.370580519 +0000
+@@ -12093,9 +12093,9 @@ print_dynamic_symbol (Filedata *filedata
+   int len_avail = 21;
+   if (! do_wide && version_string != NULL)
+     {
+-      char buffer[256];
++      char buffer[16];
+ 
+-      len_avail -= sprintf (buffer, "@%s", version_string);
++      len_avail -= 1 + strlen (version_string);
+ 
+       if (sym_info == symbol_undefined)
+ 	len_avail -= sprintf (buffer," (%d)", vna_other);

binutils-CVE-2021-3487.patch

@@ -0,0 +1,34 @@
+--- binutils.orig/bfd/dwarf2.c	2021-04-09 16:59:18.345187116 +0100
++++ binutils-2.35/bfd/dwarf2.c	2021-04-09 17:02:03.614064723 +0100
+@@ -539,6 +539,8 @@ read_section (bfd *	      abfd,
+   /* The section may have already been read.  */
+   if (contents == NULL)
+     {
++      ufile_ptr  filesize;
++
+       msec = bfd_get_section_by_name (abfd, section_name);
+       if (! msec)
+ 	{
+@@ -554,10 +556,20 @@ read_section (bfd *	      abfd,
+ 	  return FALSE;
+ 	}
+ 
+-      *section_size = msec->rawsize ? msec->rawsize : msec->size;
++      amt = bfd_get_section_limit_octets (abfd, msec);
++      filesize = bfd_get_file_size (abfd);
++      if (amt >= filesize)
++       {
++         /* PR 26946 */
++         _bfd_error_handler (_("DWARF error: section %s is larger than its filesize! (0x%lx vs 0x%lx)"),
++                             section_name, (long) amt, (long) filesize);
++         bfd_set_error (bfd_error_bad_value);
++         return FALSE;
++       }
++      *section_size = amt;
+       /* Paranoia - alloc one extra so that we can make sure a string
+ 	 section is NUL terminated.  */
+-      amt = *section_size + 1;
++      amt += 1;
+       if (amt == 0)
+ 	{
+ 	  bfd_set_error (bfd_error_no_memory);

binutils-dwarf-type-sign.patch

@@ -0,0 +1,931 @@
+--- binutils.orig/binutils/dwarf.c	2020-10-21 14:15:47.101351869 +0100
++++ binutils-2.35.1/binutils/dwarf.c	2020-10-21 14:17:44.608585923 +0100
+@@ -1868,7 +1868,7 @@ skip_attr_bytes (unsigned long
+     case DW_FORM_ref_addr:
+       if (dwarf_version == 2)
+ 	SAFE_BYTE_GET_AND_INC (uvalue, data, pointer_size, end);
+-      else if (dwarf_version == 3 || dwarf_version == 4)
++      else if (dwarf_version > 2)
+ 	SAFE_BYTE_GET_AND_INC (uvalue, data, offset_size, end);
+       else
+ 	return NULL;
+@@ -1920,6 +1920,7 @@ skip_attr_bytes (unsigned long
+ 
+     case DW_FORM_ref8:
+     case DW_FORM_data8:
++    case DW_FORM_ref_sig8:
+       data += 8;
+       break;
+ 
+@@ -1934,6 +1935,7 @@ skip_attr_bytes (unsigned long
+     case DW_FORM_block:
+     case DW_FORM_exprloc:
+       READ_ULEB (uvalue, data, end);
++      data += uvalue;
+       break;
+ 
+     case DW_FORM_block1:
+@@ -1951,12 +1953,12 @@ skip_attr_bytes (unsigned long
+       data += 4 + uvalue;
+       break;
+ 
+-    case DW_FORM_ref_sig8:
+-      data += 8;
+-      break;
+-
+     case DW_FORM_indirect:
+-      /* FIXME: Handle this form.  */
++      READ_ULEB (form, data, end);
++      if (form == DW_FORM_implicit_const)
++	SKIP_ULEB (data, end);
++      return skip_attr_bytes (form, data, end, pointer_size, offset_size, dwarf_version, value_return);
++
+     default:
+       return NULL;
+     }
+@@ -1978,7 +1980,7 @@ get_type_signedness (unsigned char *
+ 		     dwarf_vma              offset_size,
+ 		     int                    dwarf_version,
+ 		     bfd_boolean *          is_signed,
+-		     bfd_boolean	    is_nested)
++		     unsigned int	    nesting)
+ {
+   unsigned long   abbrev_number;
+   abbrev_entry *  entry;
+@@ -1997,6 +1999,14 @@ get_type_signedness (unsigned char *
+     /* FIXME: Issue a warning ?  */
+     return;
+ 
++#define MAX_NESTING 20
++  if (nesting > MAX_NESTING)
++    {
++      /* FIXME: Warn - or is this expected ?
++	 NB/ We need to avoid infinite recursion.  */
++      return;
++    }
++
+   for (attr = entry->first_attr;
+        attr != NULL && attr->attribute;
+        attr = attr->next)
+@@ -2019,16 +2029,12 @@ get_type_signedness (unsigned char *
+ #endif
+ 	case DW_AT_type:
+ 	  /* Recurse.  */
+-	  if (is_nested)
+-	    {
+-	      /* FIXME: Warn - or is this expected ?
+-		 NB/ We need to avoid infinite recursion.  */
+-	      return;
+-	    }
+ 	  if (uvalue >= (size_t) (end - start))
+ 	    return;
+-	  get_type_signedness (start, start + uvalue, end, pointer_size,
+-			       offset_size, dwarf_version, is_signed, TRUE);
++	  /* We cannot correctly process DW_FORM_ref_addr at the moment.  */
++	  if (attr->form != DW_FORM_ref_addr)
++	    get_type_signedness (start, start + uvalue, end, pointer_size,
++				 offset_size, dwarf_version, is_signed, nesting + 1);
+ 	  break;
+ 
+ 	case DW_AT_encoding:
+@@ -2206,7 +2212,6 @@ read_and_display_attr_value (unsigned lo
+ 	SAFE_BYTE_GET_AND_INC (uvalue, data, offset_size, end);
+       else
+ 	error (_("Internal error: DWARF version is not 2, 3 or 4.\n"));
+-
+       break;
+ 
+     case DW_FORM_addr:
+@@ -2246,8 +2251,8 @@ read_and_display_attr_value (unsigned lo
+       uvalue = svalue;
+       break;
+ 
+-    case DW_FORM_GNU_str_index:
+     case DW_FORM_ref_udata:
++    case DW_FORM_GNU_str_index:
+     case DW_FORM_udata:
+     case DW_FORM_GNU_addr_index:
+       READ_ULEB (uvalue, data, end);
+@@ -2663,8 +2668,10 @@ read_and_display_attr_value (unsigned lo
+ 	{
+ 	  bfd_boolean is_signed = FALSE;
+ 
+-	  get_type_signedness (start, start + uvalue, end, pointer_size,
+-			       offset_size, dwarf_version, & is_signed, FALSE);
++	  /* We cannot correctly process DW_FORM_ref_addr at the moment.  */
++	  if (form != DW_FORM_ref_addr)
++	    get_type_signedness (start, start + uvalue, end, pointer_size,
++				 offset_size, dwarf_version, & is_signed, 0);
+ 	  level_type_signed[level] = is_signed;
+ 	}
+       break;
+diff -rup binutils.orig/binutils/dwarf.c binutils-2.35.1/binutils/dwarf.c
+--- binutils.orig/binutils/dwarf.c	2020-10-27 16:24:29.489636820 +0000
++++ binutils-2.35.1/binutils/dwarf.c	2020-10-27 16:24:44.507568083 +0000
+@@ -849,101 +849,204 @@ fetch_indexed_value (dwarf_vma offset, d
+ /* FIXME:  There are better and more efficient ways to handle
+    these structures.  For now though, I just want something that
+    is simple to implement.  */
++/* Records a single attribute in an abbrev.  */
+ typedef struct abbrev_attr
+ {
+-  unsigned long attribute;
+-  unsigned long form;
+-  bfd_signed_vma implicit_const;
+-  struct abbrev_attr *next;
++  unsigned long          attribute;
++  unsigned long          form;
++  bfd_signed_vma         implicit_const;
++  struct abbrev_attr *   next;
+ }
+ abbrev_attr;
+ 
++/* Records a single abbrev.  */
+ typedef struct abbrev_entry
+ {
+-  unsigned long entry;
+-  unsigned long tag;
+-  int children;
+-  struct abbrev_attr *first_attr;
+-  struct abbrev_attr *last_attr;
+-  struct abbrev_entry *next;
++  unsigned long          number;
++  unsigned long          tag;
++  int                    children;
++  struct abbrev_attr *   first_attr;
++  struct abbrev_attr *   last_attr;
++  struct abbrev_entry *  next;
+ }
+ abbrev_entry;
+ 
+-static abbrev_entry *first_abbrev = NULL;
+-static abbrev_entry *last_abbrev = NULL;
++/* Records a set of abbreviations.  */
++typedef struct abbrev_list
++{
++  abbrev_entry *        first_abbrev;
++  abbrev_entry *        last_abbrev;
++  dwarf_vma             abbrev_offset;
++  struct abbrev_list *  next;
++  unsigned char *       start_of_next_abbrevs;
++}
++abbrev_list;
++
++/* Records all the abbrevs found so far.  */
++static struct abbrev_list * abbrev_lists = NULL;
++
++typedef struct abbrev_map
++{
++  dwarf_vma      start;
++  dwarf_vma      end;
++  abbrev_list *  list;
++} abbrev_map;
++
++/* Maps between CU offsets and abbrev sets.  */
++static abbrev_map *   cu_abbrev_map = NULL;
++static unsigned long  num_abbrev_map_entries = 0;
++static unsigned long  next_free_abbrev_map_entry = 0;
++
++#define INITIAL_NUM_ABBREV_MAP_ENTRIES 8
++#define ABBREV_MAP_ENTRIES_INCREMENT   8
++
++static void
++record_abbrev_list_for_cu (dwarf_vma start, dwarf_vma end, abbrev_list * list)
++{
++  if (cu_abbrev_map == NULL)
++    {
++      num_abbrev_map_entries = INITIAL_NUM_ABBREV_MAP_ENTRIES;
++      cu_abbrev_map = xmalloc (num_abbrev_map_entries * sizeof (* cu_abbrev_map));
++    }
++  else if (next_free_abbrev_map_entry == num_abbrev_map_entries)
++    {
++      num_abbrev_map_entries += ABBREV_MAP_ENTRIES_INCREMENT;
++      cu_abbrev_map = xrealloc (cu_abbrev_map, num_abbrev_map_entries * sizeof (* cu_abbrev_map));
++    }
++
++  cu_abbrev_map[next_free_abbrev_map_entry].start = start;
++  cu_abbrev_map[next_free_abbrev_map_entry].end = end;
++  cu_abbrev_map[next_free_abbrev_map_entry].list = list;
++  next_free_abbrev_map_entry ++;
++}
+ 
+ static void
+-free_abbrevs (void)
++free_all_abbrevs (void)
+ {
+-  abbrev_entry *abbrv;
++  abbrev_list *  list;
+ 
+-  for (abbrv = first_abbrev; abbrv;)
++  for (list = abbrev_lists; list != NULL;)
+     {
+-      abbrev_entry *next_abbrev = abbrv->next;
+-      abbrev_attr *attr;
++      abbrev_list *   next = list->next;
++      abbrev_entry *  abbrv;
+ 
+-      for (attr = abbrv->first_attr; attr;)
++      for (abbrv = list->first_abbrev; abbrv != NULL;)
+ 	{
+-	  abbrev_attr *next_attr = attr->next;
++	  abbrev_entry *  next_abbrev = abbrv->next;
++	  abbrev_attr *   attr;
+ 
+-	  free (attr);
+-	  attr = next_attr;
++	  for (attr = abbrv->first_attr; attr;)
++	    {
++	      abbrev_attr *next_attr = attr->next;
++
++	      free (attr);
++	      attr = next_attr;
++	    }
++
++	  free (abbrv);
++	  abbrv = next_abbrev;
+ 	}
+ 
+-      free (abbrv);
+-      abbrv = next_abbrev;
++      free (list);
++      list = next;
+     }
+ 
+-  last_abbrev = first_abbrev = NULL;
++  abbrev_lists = NULL;
++}
++
++static abbrev_list *
++new_abbrev_list (dwarf_vma abbrev_offset)
++{
++  abbrev_list * list = (abbrev_list *) xcalloc (sizeof * list, 1);
++
++  list->abbrev_offset = abbrev_offset;
++
++  list->next = abbrev_lists;
++  abbrev_lists = list;
++
++  return list;
++}
++
++static abbrev_list *
++find_abbrev_list_by_abbrev_offset (dwarf_vma abbrev_offset)
++{
++  abbrev_list * list;
++
++  for (list = abbrev_lists; list != NULL; list = list->next)
++    if (list->abbrev_offset == abbrev_offset)
++      return list;
++
++  return NULL;
++}
++
++/* Find the abbreviation map for the CU that includes OFFSET.
++   OFFSET is an absolute offset from the start of the .debug_info section.  */
++/* FIXME: This function is going to slow down readelf & objdump.
++   Consider using a better algorithm to mitigate this effect.  */
++
++static  abbrev_map *
++find_abbrev_map_by_offset (dwarf_vma offset)
++{
++  unsigned long i;
++
++  for (i = 0; i < next_free_abbrev_map_entry; i++)
++    if (cu_abbrev_map[i].start <= offset
++	&& cu_abbrev_map[i].end > offset)
++      return cu_abbrev_map + i;
++
++  return NULL;	
+ }
+ 
+ static void
+-add_abbrev (unsigned long number, unsigned long tag, int children)
++add_abbrev (unsigned long  number,
++	    unsigned long  tag,
++	    int            children,
++	    abbrev_list *  list)
+ {
+-  abbrev_entry *entry;
++  abbrev_entry *  entry;
+ 
+-  entry = (abbrev_entry *) malloc (sizeof (*entry));
+-  if (entry == NULL)
+-    /* ugg */
+-    return;
++  entry = (abbrev_entry *) xmalloc (sizeof (*entry));
+ 
+-  entry->entry      = number;
++  entry->number     = number;
+   entry->tag        = tag;
+   entry->children   = children;
+   entry->first_attr = NULL;
+   entry->last_attr  = NULL;
+   entry->next       = NULL;
+ 
+-  if (first_abbrev == NULL)
+-    first_abbrev = entry;
++  assert (list != NULL);
++
++  if (list->first_abbrev == NULL)
++    list->first_abbrev = entry;
+   else
+-    last_abbrev->next = entry;
++    list->last_abbrev->next = entry;
+ 
+-  last_abbrev = entry;
++  list->last_abbrev = entry;
+ }
+ 
+ static void
+-add_abbrev_attr (unsigned long attribute, unsigned long form,
+-		 bfd_signed_vma implicit_const)
++add_abbrev_attr (unsigned long   attribute,
++		 unsigned long   form,
++		 bfd_signed_vma  implicit_const,
++		 abbrev_list *   list)
+ {
+   abbrev_attr *attr;
+ 
+-  attr = (abbrev_attr *) malloc (sizeof (*attr));
+-  if (attr == NULL)
+-    /* ugg */
+-    return;
++  attr = (abbrev_attr *) xmalloc (sizeof (*attr));
+ 
+   attr->attribute = attribute;
+   attr->form      = form;
+   attr->implicit_const = implicit_const;
+   attr->next      = NULL;
+ 
+-  if (last_abbrev->first_attr == NULL)
+-    last_abbrev->first_attr = attr;
++  assert (list != NULL && list->last_abbrev != NULL);
++
++  if (list->last_abbrev->first_attr == NULL)
++    list->last_abbrev->first_attr = attr;
+   else
+-    last_abbrev->last_attr->next = attr;
++    list->last_abbrev->last_attr->next = attr;
+ 
+-  last_abbrev->last_attr = attr;
++  list->last_abbrev->last_attr = attr;
+ }
+ 
+ /* Processes the (partial) contents of a .debug_abbrev section.
+@@ -952,11 +1055,10 @@ add_abbrev_attr (unsigned long attribute
+    an abbreviation set was found.  */
+ 
+ static unsigned char *
+-process_abbrev_section (unsigned char *start, unsigned char *end)
++process_abbrev_set (unsigned char *        start,
++		    const unsigned char *  end,
++		    abbrev_list *          list)
+ {
+-  if (first_abbrev != NULL)
+-    return NULL;
+-
+   while (start < end)
+     {
+       unsigned long entry;
+@@ -966,7 +1068,7 @@ process_abbrev_section (unsigned char *s
+ 
+       READ_ULEB (entry, start, end);
+ 
+-      /* A single zero is supposed to end the section according
++      /* A single zero is supposed to end the set according
+ 	 to the standard.  If there's more, then signal that to
+ 	 the caller.  */
+       if (start == end)
+@@ -980,7 +1082,7 @@ process_abbrev_section (unsigned char *s
+ 
+       children = *start++;
+ 
+-      add_abbrev (entry, tag, children);
++      add_abbrev (entry, tag, children, list);
+ 
+       do
+ 	{
+@@ -1003,7 +1105,7 @@ process_abbrev_section (unsigned char *s
+ 		break;
+ 	    }
+ 
+-	  add_abbrev_attr (attribute, form, implicit_const);
++	  add_abbrev_attr (attribute, form, implicit_const, list);
+ 	}
+       while (attribute != 0);
+     }
+@@ -1969,36 +2071,123 @@ skip_attr_bytes (unsigned long
+   return data;
+ }
+ 
+-/* Return IS_SIGNED set to TRUE if the type at
+-   DATA can be determined to be a signed type.  */
++/* Given form FORM with value UVALUE, locate and return the abbreviation
++   associated with it.  */
++
++static abbrev_entry *
++get_type_abbrev_from_form (unsigned long                 form,
++			   unsigned long                 uvalue,
++			   dwarf_vma                     cu_offset,
++			   const struct dwarf_section *  section,
++			   unsigned long *               abbrev_num_return,
++			   unsigned char **              data_return,
++			   unsigned long *               cu_offset_return)
++{
++  unsigned long   abbrev_number;
++  abbrev_map *    map;
++  abbrev_entry *  entry;
++  unsigned char * data;
++
++  if (abbrev_num_return != NULL)
++    * abbrev_num_return = 0;
++  if (data_return != NULL)
++    * data_return = NULL;
++
++  switch (form)
++    {
++    case DW_FORM_GNU_ref_alt:
++      /* FIXME: We are unable to handle this form at the moment.  */
++      return NULL;
++
++    case DW_FORM_ref_addr:
++      if (uvalue >= section->size)
++	{
++	  warn (_("Unable to resolve ref_addr form: uvalue %lx > section size %lx (%s)\n"),
++		uvalue, (long) section->size, section->name);
++	  return NULL;
++	}
++      break;
++
++    case DW_FORM_ref1:
++    case DW_FORM_ref2:
++    case DW_FORM_ref4:
++    case DW_FORM_ref_udata:
++      if (uvalue + cu_offset > section->size)
++	{
++	  warn (_("Unable to resolve ref form: uvalue %lx + cu_offset %lx > section size %lx\n"),
++		uvalue, (long) cu_offset, (long) section->size);
++	  return NULL;
++	}
++      uvalue += cu_offset;
++      break;
++
++      /* FIXME: Are there other DW_FORMs that can be used by types ?  */
++
++    default:
++      warn (_("Unexpected form %lx encountered whilst finding abbreviation for type\n"), form);
++      return NULL;
++    }
++
++  data = (unsigned char *) section->start + uvalue;
++  map = find_abbrev_map_by_offset (uvalue);
++  
++  if (map == NULL)
++    {
++      warn (_("Unable to find abbreviations for CU offset %#lx\n"), uvalue);
++      return NULL;
++    }
++  if (map->list == NULL)
++    {
++      warn (_("Empty abbreviation list encountered for CU offset %lx\n"), uvalue);
++      return NULL;
++    }
++
++  if (cu_offset_return != NULL)
++    {
++      if (form == DW_FORM_ref_addr)
++	* cu_offset_return = map->start;
++      else
++	* cu_offset_return = cu_offset;
++    }
++	
++  READ_ULEB (abbrev_number, data, section->start + section->size);
++
++  for (entry = map->list->first_abbrev; entry != NULL; entry = entry->next)
++    if (entry->number == abbrev_number)
++      break;
++  
++  if (abbrev_num_return != NULL)
++    * abbrev_num_return = abbrev_number;
++
++  if (data_return != NULL)
++    * data_return = data;
++
++  if (entry == NULL)
++    warn (_("Unable to find entry for abbreviation %lu\n"), abbrev_number);
++
++  return entry;
++}
++
++/* Return IS_SIGNED set to TRUE if the type using abbreviation ENTRY
++   can be determined to be a signed type.  The data for ENTRY can be
++   found starting at DATA.  */
+ 
+ static void
+-get_type_signedness (unsigned char *        start,
++get_type_signedness (abbrev_entry *         entry,
++		     const struct dwarf_section * section,
+ 		     unsigned char *        data,
+ 		     unsigned const char *  end,
++		     dwarf_vma              cu_offset,
+ 		     dwarf_vma              pointer_size,
+ 		     dwarf_vma              offset_size,
+ 		     int                    dwarf_version,
+ 		     bfd_boolean *          is_signed,
+ 		     unsigned int	    nesting)
+ {
+-  unsigned long   abbrev_number;
+-  abbrev_entry *  entry;
+   abbrev_attr *   attr;
+ 
+   * is_signed = FALSE;
+ 
+-  READ_ULEB (abbrev_number, data, end);
+-
+-  for (entry = first_abbrev;
+-       entry != NULL && entry->entry != abbrev_number;
+-       entry = entry->next)
+-    continue;
+-
+-  if (entry == NULL)
+-    /* FIXME: Issue a warning ?  */
+-    return;
+-
+ #define MAX_NESTING 20
+   if (nesting > MAX_NESTING)
+     {
+@@ -2011,6 +2200,7 @@ get_type_signedness (unsigned char *
+        attr != NULL && attr->attribute;
+        attr = attr->next)
+     {
++      unsigned char * orig_data = data;
+       dwarf_vma uvalue = 0;
+ 
+       data = skip_attr_bytes (attr->form, data, end, pointer_size,
+@@ -2020,21 +2210,38 @@ get_type_signedness (unsigned char *
+ 
+       switch (attr->attribute)
+ 	{
+-#if 0 /* FIXME: It would be nice to print the name of the type,
+-	 but this would mean updating a lot of binutils tests.  */
++	case DW_AT_linkage_name:
+ 	case DW_AT_name:
+-	  if (attr->form == DW_FORM_strp)
+-	    printf ("%s", fetch_indirect_string (uvalue));
++	  if (do_wide)
++	    {
++	      if (attr->form == DW_FORM_strp)
++		printf (", %s", fetch_indirect_string (uvalue));
++	      else if (attr->form == DW_FORM_string)
++		printf (", %s", orig_data);
++	    }
+ 	  break;
+-#endif
++
+ 	case DW_AT_type:
+ 	  /* Recurse.  */
+-	  if (uvalue >= (size_t) (end - start))
+-	    return;
+-	  /* We cannot correctly process DW_FORM_ref_addr at the moment.  */
+-	  if (attr->form != DW_FORM_ref_addr)
+-	    get_type_signedness (start, start + uvalue, end, pointer_size,
+-				 offset_size, dwarf_version, is_signed, nesting + 1);
++	  {
++	    abbrev_entry *  type_abbrev;
++	    unsigned char * type_data;
++	    unsigned long   type_cu_offset;
++
++	    type_abbrev = get_type_abbrev_from_form (attr->form,
++						     uvalue,
++						     cu_offset,
++						     section,
++						     NULL /* abbrev num return */,
++						     & type_data,
++						     & type_cu_offset);
++	    if (type_abbrev == NULL)
++	      break;
++
++	    get_type_signedness (type_abbrev, section, type_data, end, type_cu_offset,
++				 pointer_size, offset_size, dwarf_version,
++				 is_signed, nesting + 1);
++	  }
+ 	  break;
+ 
+ 	case DW_AT_encoding:
+@@ -2276,12 +2483,12 @@ read_and_display_attr_value (unsigned lo
+     {
+     case DW_FORM_ref_addr:
+       if (!do_loc)
+-	printf ("%c<0x%s>", delimiter, dwarf_vmatoa ("x",uvalue));
++	printf ("%c<0x%s>", delimiter, dwarf_vmatoa ("x", uvalue));
+       break;
+ 
+     case DW_FORM_GNU_ref_alt:
+       if (!do_loc)
+-	printf ("%c<alt 0x%s>", delimiter, dwarf_vmatoa ("x",uvalue));
++	printf ("%c<alt 0x%s>", delimiter, dwarf_vmatoa ("x", uvalue));
+       /* FIXME: Follow the reference...  */
+       break;
+ 
+@@ -2667,11 +2874,18 @@ read_and_display_attr_value (unsigned lo
+ 	  && uvalue < (size_t) (end - start))
+ 	{
+ 	  bfd_boolean is_signed = FALSE;
+-
+-	  /* We cannot correctly process DW_FORM_ref_addr at the moment.  */
+-	  if (form != DW_FORM_ref_addr)
+-	    get_type_signedness (start, start + uvalue, end, pointer_size,
+-				 offset_size, dwarf_version, & is_signed, 0);
++	  abbrev_entry *  type_abbrev;
++	  unsigned char * type_data;
++	  unsigned long   type_cu_offset;
++	  
++	  type_abbrev = get_type_abbrev_from_form (form, uvalue, cu_offset,
++						   section, NULL, & type_data, & type_cu_offset);
++	  if (type_abbrev != NULL)
++	    {
++	      get_type_signedness (type_abbrev, section, type_data, end, type_cu_offset,
++				   pointer_size, offset_size, dwarf_version,
++				   & is_signed, 0);
++	    }
+ 	  level_type_signed[level] = is_signed;
+ 	}
+       break;
+@@ -2993,40 +3207,22 @@ read_and_display_attr_value (unsigned lo
+ 
+     case DW_AT_import:
+       {
+-	if (form == DW_FORM_ref_sig8
+-	    || form == DW_FORM_GNU_ref_alt)
+-	  break;
+-
+-	if (form == DW_FORM_ref1
+-	    || form == DW_FORM_ref2
+-	    || form == DW_FORM_ref4
+-	    || form == DW_FORM_ref_udata)
+-	  uvalue += cu_offset;
++	unsigned long abbrev_number;
++	abbrev_entry *entry;
+ 
+-	if (uvalue >= section->size)
+-	  warn (_("Offset %s used as value for DW_AT_import attribute of DIE at offset 0x%lx is too big.\n"),
+-		dwarf_vmatoa ("x", uvalue),
+-		(unsigned long) (orig_data - section->start));
++	entry = get_type_abbrev_from_form (form, uvalue, cu_offset,
++					   section, & abbrev_number, NULL, NULL);
++	if (entry == NULL)
++	  {
++	    if (form != DW_FORM_GNU_ref_alt)
++	      warn (_("Offset %s used as value for DW_AT_import attribute of DIE at offset 0x%lx is too big.\n"),
++		    dwarf_vmatoa ("x", uvalue),
++		    (unsigned long) (orig_data - section->start));
++	  }
+ 	else
+ 	  {
+-	    unsigned long abbrev_number;
+-	    abbrev_entry *entry;
+-	    unsigned char *p = section->start + uvalue;
+-
+-	    READ_ULEB (abbrev_number, p, end);
+-
+ 	    printf (_("\t[Abbrev Number: %ld"), abbrev_number);
+-	    /* Don't look up abbrev for DW_FORM_ref_addr, as it very often will
+-	       use different abbrev table, and we don't track .debug_info chunks
+-	       yet.  */
+-	    if (form != DW_FORM_ref_addr)
+-	      {
+-		for (entry = first_abbrev; entry != NULL; entry = entry->next)
+-		  if (entry->entry == abbrev_number)
+-		    break;
+-		if (entry != NULL)
+-		  printf (" (%s)", get_TAG_name (entry->tag));
+-	      }
++	    printf (" (%s)", get_TAG_name (entry->tag));
+ 	    printf ("]");
+ 	  }
+       }
+@@ -3245,8 +3441,98 @@ process_debug_info (struct dwarf_section
+ 
+   if (!do_loc && dwarf_start_die == 0)
+     introduce (section, FALSE);
++
++  free_all_abbrevs ();
++  free (cu_abbrev_map);
++  cu_abbrev_map = NULL;
++  next_free_abbrev_map_entry = 0;
+   
+-  for (section_begin = start, unit = 0; start < end; unit++)
++  /* In order to be able to resolve DW_FORM_ref_attr forms we need
++     to load *all* of the abbrevs for all CUs in this .debug_info
++     section.  This does effectively mean that we (partially) read
++     every CU header twice.  */
++  for (section_begin = start; start < end;)
++    {
++      DWARF2_Internal_CompUnit  compunit;
++      unsigned char *           hdrptr;
++      dwarf_vma                 cu_offset;
++      unsigned int              offset_size;
++      unsigned int              initial_length_size;
++      struct cu_tu_set *        this_set;
++      abbrev_list *             list;
++
++      hdrptr = start;
++
++      SAFE_BYTE_GET_AND_INC (compunit.cu_length, hdrptr, 4, end);
++
++      if (compunit.cu_length == 0xffffffff)
++	{
++	  SAFE_BYTE_GET_AND_INC (compunit.cu_length, hdrptr, 8, end);
++	  offset_size = 8;
++	  initial_length_size = 12;
++	}
++      else
++	{
++	  offset_size = 4;
++	  initial_length_size = 4;
++	}
++
++      SAFE_BYTE_GET_AND_INC (compunit.cu_version, hdrptr, 2, end);
++
++      cu_offset = start - section_begin;
++
++      this_set = find_cu_tu_set_v2 (cu_offset, do_types);
++
++      if (compunit.cu_version < 5)
++	{
++	  compunit.cu_unit_type = DW_UT_compile;
++	  /* Initialize it due to a false compiler warning.  */
++	  compunit.cu_pointer_size = -1;
++	}
++      else
++	{
++	  SAFE_BYTE_GET_AND_INC (compunit.cu_unit_type, hdrptr, 1, end);
++	  do_types = (compunit.cu_unit_type == DW_UT_type);
++
++	  SAFE_BYTE_GET_AND_INC (compunit.cu_pointer_size, hdrptr, 1, end);
++	}
++
++      SAFE_BYTE_GET_AND_INC (compunit.cu_abbrev_offset, hdrptr, offset_size, end);
++
++      list = find_abbrev_list_by_abbrev_offset (compunit.cu_abbrev_offset);
++      if (list == NULL)
++	{
++	  dwarf_vma        abbrev_base;
++	  size_t           abbrev_size;
++	  unsigned char *  next;
++
++	  if (this_set == NULL)
++	    {
++	      abbrev_base = 0;
++	      abbrev_size = debug_displays [abbrev_sec].section.size;
++	    }
++	  else
++	    {
++	      abbrev_base = this_set->section_offsets [DW_SECT_ABBREV];
++	      abbrev_size = this_set->section_sizes [DW_SECT_ABBREV];
++	    }
++
++	  list = new_abbrev_list (compunit.cu_abbrev_offset);
++	  next = process_abbrev_set
++	    (((unsigned char *) debug_displays [abbrev_sec].section.start
++	      + abbrev_base + compunit.cu_abbrev_offset),
++	     ((unsigned char *) debug_displays [abbrev_sec].section.start
++	      + abbrev_base + abbrev_size),
++	     list);
++	  list->start_of_next_abbrevs = next;
++	}
++		       
++      start = section_begin + cu_offset + compunit.cu_length
++	+ initial_length_size;
++      record_abbrev_list_for_cu (cu_offset, start - section_begin, list);
++    }
++
++  for (start = section_begin, unit = 0; start < end; unit++)
+     {
+       DWARF2_Internal_CompUnit compunit;
+       unsigned char *hdrptr;
+@@ -3262,6 +3548,7 @@ process_debug_info (struct dwarf_section
+       struct cu_tu_set *this_set;
+       dwarf_vma abbrev_base;
+       size_t abbrev_size;
++      abbrev_list * list = NULL;
+ 
+       hdrptr = start;
+ 
+@@ -3434,8 +3721,6 @@ process_debug_info (struct dwarf_section
+ 	  continue;
+ 	}
+ 
+-      free_abbrevs ();
+-
+       /* Process the abbrevs used by this compilation unit.  */
+       if (compunit.cu_abbrev_offset >= abbrev_size)
+ 	warn (_("Debug info is corrupted, abbrev offset (%lx) is larger than abbrev section size (%lx)\n"),
+@@ -3448,11 +3733,22 @@ process_debug_info (struct dwarf_section
+ 	      (unsigned long) abbrev_base + abbrev_size,
+ 	      (unsigned long) debug_displays [abbrev_sec].section.size);
+       else
+-	process_abbrev_section
+-	  (((unsigned char *) debug_displays [abbrev_sec].section.start
+-	    + abbrev_base + compunit.cu_abbrev_offset),
+-	   ((unsigned char *) debug_displays [abbrev_sec].section.start
+-	    + abbrev_base + abbrev_size));
++	{
++	  list = find_abbrev_list_by_abbrev_offset (compunit.cu_abbrev_offset);
++	  if (list == NULL)
++	    {
++	      unsigned char * next;
++
++	      list = new_abbrev_list (compunit.cu_abbrev_offset);
++	      next = process_abbrev_set
++		(((unsigned char *) debug_displays [abbrev_sec].section.start
++		  + abbrev_base + compunit.cu_abbrev_offset),
++		 ((unsigned char *) debug_displays [abbrev_sec].section.start
++		  + abbrev_base + abbrev_size),
++		 list);
++	      list->start_of_next_abbrevs = next;
++	    }
++	}
+ 
+       level = 0;
+       last_level = level;
+@@ -3532,11 +3828,13 @@ process_debug_info (struct dwarf_section
+ 
+ 	  /* Scan through the abbreviation list until we reach the
+ 	     correct entry.  */
+-	  for (entry = first_abbrev;
+-	       entry && entry->entry != abbrev_number;
+-	       entry = entry->next)
++	  if (list == NULL)
+ 	    continue;
+ 
++	  for (entry = list->first_abbrev; entry != NULL; entry = entry->next)
++	    if (entry->number == abbrev_number)
++	      break;
++
+ 	  if (entry == NULL)
+ 	    {
+ 	      if (!do_loc && do_printing)
+@@ -5721,30 +6019,37 @@ display_debug_abbrev (struct dwarf_secti
+ {
+   abbrev_entry *entry;
+   unsigned char *start = section->start;
+-  unsigned char *end = start + section->size;
++  const unsigned char *end = start + section->size;
+ 
+   introduce (section, FALSE);
+ 
+   do
+     {
+-      unsigned char *last;
+-
+-      free_abbrevs ();
++      abbrev_list *    list;
++      dwarf_vma        offset;
+ 
+-      last = start;
+-      start = process_abbrev_section (start, end);
++      offset = start - section->start;
++      list = find_abbrev_list_by_abbrev_offset (offset);
++      if (list == NULL)
++	{
++	  list = new_abbrev_list (offset);
++	  start = process_abbrev_set (start, end, list);
++	  list->start_of_next_abbrevs = start;
++	}
++      else
++	start = list->start_of_next_abbrevs;
+ 
+-      if (first_abbrev == NULL)
++      if (list->first_abbrev == NULL)
+ 	continue;
+ 
+-      printf (_("  Number TAG (0x%lx)\n"), (long) (last - section->start));
++      printf (_("  Number TAG (0x%lx)\n"), (long) offset);
+ 
+-      for (entry = first_abbrev; entry; entry = entry->next)
++      for (entry = list->first_abbrev; entry; entry = entry->next)
+ 	{
+ 	  abbrev_attr *attr;
+ 
+ 	  printf ("   %ld      %s    [%s]\n",
+-		  entry->entry,
++		  entry->number,
+ 		  get_TAG_name (entry->tag),
+ 		  entry->children ? _("has children") : _("no children"));
+ 
+@@ -10776,8 +11081,12 @@ free_debug_memory (void)
+ {
+   unsigned int i;
+ 
+-  free_abbrevs ();
++  free_all_abbrevs ();
+ 
++  free (cu_abbrev_map);
++  cu_abbrev_map = NULL;
++  next_free_abbrev_map_entry = 0;
++  
+   for (i = 0; i < max; i++)
+     free_debug_section ((enum dwarf_section_display_enum) i);
+ 
+Only in binutils-2.35.1/binutils: dwarf.c.orig

binutils-gold-gnu-properties.patch

@@ -0,0 +1,181 @@
+diff -rup binutils.orig/gold/testsuite/gnu_property_a.S binutils-2.35/gold/testsuite/gnu_property_a.S
+--- binutils.orig/gold/testsuite/gnu_property_a.S	2021-01-18 14:01:41.228809868 +0000
++++ binutils-2.35/gold/testsuite/gnu_property_a.S	2021-01-18 14:01:52.542736705 +0000
+@@ -1,8 +1,8 @@
+ #define NT_GNU_PROPERTY_TYPE_0 5
+ 
+ #define GNU_PROPERTY_STACK_SIZE 1
+-#define GNU_PROPERTY_X86_ISA_1_USED 0xc0000000
+-#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0000001
++#define GNU_PROPERTY_X86_ISA_1_USED 0xc0010002
++#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0008002
+ #define GNU_PROPERTY_X86_FEATURE_1_AND 0xc0000002
+ 
+ #if __SIZEOF_PTRDIFF_T__  == 8
+diff -rup binutils.orig/gold/testsuite/gnu_property_b.S binutils-2.35/gold/testsuite/gnu_property_b.S
+--- binutils.orig/gold/testsuite/gnu_property_b.S	2021-01-18 14:01:41.233809836 +0000
++++ binutils-2.35/gold/testsuite/gnu_property_b.S	2021-01-18 14:01:52.542736705 +0000
+@@ -2,8 +2,8 @@
+ 
+ #define GNU_PROPERTY_STACK_SIZE 1
+ #define GNU_PROPERTY_NO_COPY_ON_PROTECTED 2
+-#define GNU_PROPERTY_X86_ISA_1_USED 0xc0000000
+-#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0000001
++#define GNU_PROPERTY_X86_ISA_1_USED 0xc0010002
++#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0008002
+ #define GNU_PROPERTY_X86_FEATURE_1_AND 0xc0000002
+ 
+ #if __SIZEOF_PTRDIFF_T__  == 8
+diff -rup binutils.orig/gold/testsuite/gnu_property_c.S binutils-2.35/gold/testsuite/gnu_property_c.S
+--- binutils.orig/gold/testsuite/gnu_property_c.S	2021-01-18 14:01:41.232809843 +0000
++++ binutils-2.35/gold/testsuite/gnu_property_c.S	2021-01-18 14:01:52.542736705 +0000
+@@ -2,8 +2,8 @@
+ 
+ #define GNU_PROPERTY_STACK_SIZE 1
+ #define GNU_PROPERTY_NO_COPY_ON_PROTECTED 2
+-#define GNU_PROPERTY_X86_ISA_1_USED 0xc0000000
+-#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0000001
++#define GNU_PROPERTY_X86_ISA_1_USED 0xc0010002
++#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0008002
+ #define GNU_PROPERTY_X86_FEATURE_1_AND 0xc0000002
+ 
+ #if __SIZEOF_PTRDIFF_T__  == 8
+diff -rup binutils.orig/gold/testsuite/gnu_property_test.sh binutils-2.35/gold/testsuite/gnu_property_test.sh
+--- binutils.orig/gold/testsuite/gnu_property_test.sh	2021-01-18 14:01:41.236809817 +0000
++++ binutils-2.35/gold/testsuite/gnu_property_test.sh	2021-01-18 14:01:52.543736699 +0000
+@@ -57,8 +57,8 @@ check_count gnu_property_test.stdout "GN
+ 
+ check gnu_property_test.stdout "stack size: 0x111100"
+ check gnu_property_test.stdout "no copy on protected"
+-check gnu_property_test.stdout "x86 ISA used: i486, SSE2, SSE4_2, AVX512CD"
+-check gnu_property_test.stdout "x86 ISA needed: i486, SSE2, SSE4_2, AVX512CD"
++check gnu_property_test.stdout "x86 ISA used: x86-64-v2, <unknown: 10>, <unknown: 100>, <unknown: 1000>"
++check gnu_property_test.stdout "x86 ISA needed: x86-64-v2, <unknown: 10>, <unknown: 100>, <unknown: 1000>"
+ check gnu_property_test.stdout "x86 feature: IBT"
+ 
+ exit 0
+diff -rup binutils.orig/gold/x86_64.cc binutils-2.35/gold/x86_64.cc
+--- binutils.orig/gold/x86_64.cc	2021-01-18 14:01:41.225809888 +0000
++++ binutils-2.35/gold/x86_64.cc	2021-01-18 14:01:52.543736699 +0000
+@@ -706,8 +706,9 @@ class Target_x86_64 : public Sized_targe
+       rela_irelative_(NULL), copy_relocs_(elfcpp::R_X86_64_COPY),
+       got_mod_index_offset_(-1U), tlsdesc_reloc_info_(),
+       tls_base_symbol_defined_(false), isa_1_used_(0), isa_1_needed_(0),
+-      feature_1_(0), object_isa_1_used_(0), object_feature_1_(0),
+-      seen_first_object_(false)
++      feature_1_(0), feature_2_used_(0), feature_2_needed_(0),
++      object_isa_1_used_(0), object_feature_1_(0),
++      object_feature_2_used_(0), seen_first_object_(false)
+   { }
+ 
+   // Hook for a new output section.
+@@ -1382,6 +1383,8 @@ class Target_x86_64 : public Sized_targe
+   uint32_t isa_1_used_;
+   uint32_t isa_1_needed_;
+   uint32_t feature_1_;
++  uint32_t feature_2_used_;
++  uint32_t feature_2_needed_;
+   // Target-specific properties from the current object.
+   // These bits get ORed into ISA_1_USED_ after all properties for the object
+   // have been processed. But if either is all zeroes (as when the property
+@@ -1391,6 +1394,7 @@ class Target_x86_64 : public Sized_targe
+   // These bits get ANDed into FEATURE_1_ after all properties for the object
+   // have been processed.
+   uint32_t object_feature_1_;
++  uint32_t object_feature_2_used_;
+   // Whether we have seen our first object, for use in initializing FEATURE_1_.
+   bool seen_first_object_;
+ };
+@@ -1594,9 +1598,15 @@ Target_x86_64<size>::record_gnu_property
+ 
+   switch (pr_type)
+     {
++    case elfcpp::GNU_PROPERTY_X86_COMPAT_ISA_1_USED:
++    case elfcpp::GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED:
++    case elfcpp::GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED:
++    case elfcpp::GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED:
+     case elfcpp::GNU_PROPERTY_X86_ISA_1_USED:
+     case elfcpp::GNU_PROPERTY_X86_ISA_1_NEEDED:
+     case elfcpp::GNU_PROPERTY_X86_FEATURE_1_AND:
++    case elfcpp::GNU_PROPERTY_X86_FEATURE_2_USED:
++    case elfcpp::GNU_PROPERTY_X86_FEATURE_2_NEEDED:
+       if (pr_datasz != 4)
+ 	{
+ 	  gold_warning(_("%s: corrupt .note.gnu.property section "
+@@ -1625,6 +1635,12 @@ Target_x86_64<size>::record_gnu_property
+       // If we see multiple feature props in one object, OR them together.
+       this->object_feature_1_ |= val;
+       break;
++    case elfcpp::GNU_PROPERTY_X86_FEATURE_2_USED:
++      this->object_feature_2_used_ |= val;
++      break;
++    case elfcpp::GNU_PROPERTY_X86_FEATURE_2_NEEDED:
++      this->feature_2_needed_ |= val;
++      break;
+     }
+ }
+ 
+@@ -1642,15 +1658,23 @@ Target_x86_64<size>::merge_gnu_propertie
+       else if (this->isa_1_used_ != 0)
+ 	this->isa_1_used_ |= this->object_isa_1_used_;
+       this->feature_1_ &= this->object_feature_1_;
++      // If any object is missing the FEATURE_2_USED property, we must
++      // omit it from the output file.
++      if (this->object_feature_2_used_ == 0)
++	this->feature_2_used_ = 0;
++      else if (this->feature_2_used_ != 0)
++	this->feature_2_used_ |= this->object_feature_2_used_;
+     }
+   else
+     {
+       this->isa_1_used_ = this->object_isa_1_used_;
+       this->feature_1_ = this->object_feature_1_;
++      this->feature_2_used_ = this->object_feature_2_used_;
+       this->seen_first_object_ = true;
+     }
+   this->object_isa_1_used_ = 0;
+   this->object_feature_1_ = 0;
++  this->object_feature_2_used_ = 0;
+ }
+ 
+ static inline void
+@@ -1676,6 +1700,12 @@ Target_x86_64<size>::do_finalize_gnu_pro
+   if (this->feature_1_ != 0)
+     add_property(layout, elfcpp::GNU_PROPERTY_X86_FEATURE_1_AND,
+ 		 this->feature_1_);
++  if (this->feature_2_used_ != 0)
++    add_property(layout, elfcpp::GNU_PROPERTY_X86_FEATURE_2_USED,
++		 this->feature_2_used_);
++  if (this->feature_2_needed_ != 0)
++    add_property(layout, elfcpp::GNU_PROPERTY_X86_FEATURE_2_NEEDED,
++		 this->feature_2_needed_);
+ }
+ 
+ // Write the first three reserved words of the .got.plt section.
+--- binutils.orig/elfcpp/elfcpp.h	2021-01-18 14:01:40.778812778 +0000
++++ binutils-2.35/elfcpp/elfcpp.h	2021-01-18 14:50:05.144035077 +0000
+@@ -1009,9 +1009,21 @@ enum
+   GNU_PROPERTY_STACK_SIZE = 1,
+   GNU_PROPERTY_NO_COPY_ON_PROTECTED = 2,
+   GNU_PROPERTY_LOPROC = 0xc0000000,
+-  GNU_PROPERTY_X86_ISA_1_USED = 0xc0000000,
+-  GNU_PROPERTY_X86_ISA_1_NEEDED = 0xc0000001,
+-  GNU_PROPERTY_X86_FEATURE_1_AND = 0xc0000002,
++  GNU_PROPERTY_X86_COMPAT_ISA_1_USED = 0xc0000000,
++  GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED = 0xc0000001,
++  GNU_PROPERTY_X86_UINT32_AND_LO = 0xc0000002,
++  GNU_PROPERTY_X86_UINT32_AND_HI = 0xc0007fff,
++  GNU_PROPERTY_X86_UINT32_OR_LO = 0xc0008000,
++  GNU_PROPERTY_X86_UINT32_OR_HI = 0xc000ffff,
++  GNU_PROPERTY_X86_UINT32_OR_AND_LO = 0xc0010000,
++  GNU_PROPERTY_X86_UINT32_OR_AND_HI = 0xc0017fff,
++  GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED = GNU_PROPERTY_X86_UINT32_OR_LO + 0,
++  GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED = GNU_PROPERTY_X86_UINT32_OR_AND_LO + 0,
++  GNU_PROPERTY_X86_FEATURE_1_AND = GNU_PROPERTY_X86_UINT32_AND_LO + 0,
++  GNU_PROPERTY_X86_ISA_1_NEEDED = GNU_PROPERTY_X86_UINT32_OR_LO + 2,
++  GNU_PROPERTY_X86_FEATURE_2_NEEDED = GNU_PROPERTY_X86_UINT32_OR_LO + 1,
++  GNU_PROPERTY_X86_ISA_1_USED = GNU_PROPERTY_X86_UINT32_OR_AND_LO + 2,
++  GNU_PROPERTY_X86_FEATURE_2_USED = GNU_PROPERTY_X86_UINT32_OR_AND_LO + 1,
+   GNU_PROPERTY_HIPROC = 0xdfffffff,
+   GNU_PROPERTY_LOUSER = 0xe0000000,
+   GNU_PROPERTY_HIUSER = 0xffffffff

binutils-plugin-as-needed.patch

@@ -0,0 +1,73 @@
+diff -rup binutils.orig/bfd/elflink.c binutils-2.35.1/bfd/elflink.c
+--- binutils.orig/bfd/elflink.c	2020-10-29 12:46:32.228618844 +0000
++++ binutils-2.35.1/bfd/elflink.c	2020-10-29 13:07:58.786847312 +0000
+@@ -5340,7 +5340,7 @@ elf_link_add_object_symbols (bfd *abfd,
+ 	  struct elf_link_hash_entry *h;
+ 	  bfd_size_type size;
+ 	  unsigned int alignment_power;
+-	  unsigned int non_ir_ref_dynamic;
++	  struct elf_link_hash_entry preserved_h;
+ 
+ 	  for (p = htab->root.table.table[i]; p != NULL; p = p->next)
+ 	    {
+@@ -5365,7 +5365,8 @@ elf_link_add_object_symbols (bfd *abfd,
+ 	      /* Preserve non_ir_ref_dynamic so that this symbol
+ 		 will be exported when the dynamic lib becomes needed
+ 		 in the second pass.  */
+-	      non_ir_ref_dynamic = h->root.non_ir_ref_dynamic;
++	      preserved_h = *h;
++
+ 	      memcpy (p, old_ent, htab->root.table.entsize);
+ 	      old_ent = (char *) old_ent + htab->root.table.entsize;
+ 	      h = (struct elf_link_hash_entry *) p;
+@@ -5382,7 +5383,10 @@ elf_link_add_object_symbols (bfd *abfd,
+ 		  if (alignment_power > h->root.u.c.p->alignment_power)
+ 		    h->root.u.c.p->alignment_power = alignment_power;
+ 		}
+-	      h->root.non_ir_ref_dynamic = non_ir_ref_dynamic;
++
++	      h->root.non_ir_ref_dynamic
++		= preserved_h.root.non_ir_ref_dynamic;
++	      h->root.as_needed_def_dynamic |= preserved_h.dynamic_def;
+ 	    }
+ 	}
+ 
+@@ -5819,6 +5823,11 @@ elf_link_add_archive_symbols (bfd *abfd,
+ 	  if (h == NULL)
+ 	    continue;
+ 
++	  /* Don't load the archive element after seeing a definition
++	     in a DT_NEEDED shared object.  */
++	  if (h->root.as_needed_def_dynamic)
++	    continue;
++
+ 	  if (h->root.type == bfd_link_hash_undefined)
+ 	    {
+ 	      /* If the archive element has already been loaded then one
+Only in binutils.orig/: binutils-2.35.1
+diff -rup binutils.orig/include/bfdlink.h binutils-2.35.1/include/bfdlink.h
+--- binutils.orig/include/bfdlink.h	2020-10-29 12:46:31.611621137 +0000
++++ binutils-2.35.1/include/bfdlink.h	2020-10-29 13:07:36.833927443 +0000
+@@ -114,6 +114,9 @@ struct bfd_link_hash_entry
+      as distinct from a LTO IR object file.  */
+   unsigned int non_ir_ref_dynamic : 1;
+ 
++  /* Symbol is defined in a DT_NEEDED dynamic object file.  */
++  unsigned int as_needed_def_dynamic : 1;
++
+   /* Symbol is a built-in define.  These will be overridden by PROVIDE
+      in a linker script.  */
+   unsigned int linker_def : 1;
+diff -rup binutils.orig/ld/plugin.c binutils-2.35.1/ld/plugin.c
+--- binutils.orig/ld/plugin.c	2020-10-29 12:46:31.878620145 +0000
++++ binutils-2.35.1/ld/plugin.c	2020-10-29 13:07:19.951989072 +0000
+@@ -794,7 +794,8 @@ get_symbols (const void *handle, int nsy
+       if (blhe->type == bfd_link_hash_undefined
+ 	  || blhe->type == bfd_link_hash_undefweak)
+ 	{
+-	  res = LDPR_UNDEF;
++	  res = (blhe->as_needed_def_dynamic
++		 ? LDPR_RESOLVED_DYN : LDPR_UNDEF);
+ 	  goto report_symbol;
+ 	}
+       if (blhe->type != bfd_link_hash_defined

binutils-strip-merge.patch

@@ -0,0 +1,19 @@
+--- binutils.orig/binutils/objcopy.c	2021-01-14 09:09:30.796925559 +0000
++++ binutils-2.35/binutils/objcopy.c	2021-01-14 15:45:38.105153686 +0000
+@@ -3313,14 +3313,12 @@ copy_object (bfd *ibfd, bfd *obfd, const
+ 	  /* It is likely that output sections are in the same order
+ 	     as the input sections, but do not assume that this is
+ 	     the case.  */
+-	  if (strcmp (bfd_section_name (merged->sec),
+-		      bfd_section_name (osec)) != 0)
++	  if (merged->sec->output_section != osec)
+ 	    {
+ 	      for (merged = merged_note_sections;
+ 		   merged != NULL;
+ 		   merged = merged->next)
+-		if (strcmp (bfd_section_name (merged->sec),
+-			    bfd_section_name (osec)) == 0)
++		if (merged->sec->output_section == osec)
+ 		  break;
+ 
+ 	      if (merged == NULL)

binutils.spec

@@ -2,7 +2,7 @@
 Summary: A GNU collection of binary utilities
 Name: %{?cross}binutils%{?_with_debug:-debug}
 Version: 2.35
-Release: 10%{?dist}
+Release: 21%{?dist}
 License: GPLv3+
 URL: https://sourceware.org/binutils
 
@@ -237,6 +237,41 @@ Patch24: binutils-aarch64-plt-sh_entsize.patch
 Patch25: binutils-add-sym-cache-to-elf-link-hash.patch
 Patch26: binutils-elf-add-objects.patch
 
+# Purpose:  Allow plugin syms to mark as-needed shared libs needed.
+# Lifetime: Fixed in 2.36
+Patch27: binutils-plugin-as-needed.patch
+
+# Purpose:  Fix the DWARF parser to skip DW_FORM_ref_addr types
+#            when attempting to determine a type's signedness.
+# Lifetime: Fixed in 2.36
+Patch28: binutils-dwarf-type-sign.patch
+
+# Purpose:  Fix some DWARF5 issues
+# Lifetime: Fixed in 2.36 and on 2.35-branch
+Patch29: binutils-dwarf5-2_35-branch.patch
+
+# Purpose:  Fix the strip program to cope when merging multiple same-named
+#            sections.
+# Lifetime: Fixed in 2.36
+Patch30: binutils-strip-merge.patch
+
+# Purpose:  Update the GOLD linker to support x86 .note.gnu.property sections.
+# Lifetime: Fixed in 2.36
+Patch31: binutils-gold-gnu-properties.patch
+
+# Purpose:  Fix an illegal memory access when using readelf to examine a corrupt file.
+# Lifetime: Fixed in 2.36
+Patch32: binutils-CVE-2021-20294.patch
+
+# Purpose:  Fix excessive memory consumption when attempting to parse corrupt
+#            DWARF debug information.
+# Lifetime: Fixed in 2.36
+Patch33: binutils-CVE-2021-3487.patch
+
+# Purpose:  Fix illegal memory access when parsing corrupt ELF files.
+# Lifetime: Fixed in 2.36
+Patch34: binutils-CVE-2020-35448.patch
+
 #----------------------------------------------------------------------------
 
 Provides: bundled(libiberty)
@@ -810,6 +845,40 @@ exit 0
 
 #----------------------------------------------------------------------------
 %changelog
+* Mon Apr 19 2021 Nick Clifton  <nickc@redhat.com> - 2.35-21
+- Fix an illegal memory access when parsing a corrupt ELF file.  (#1950481)
+
+* Fri Apr 09 2021 Nick Clifton  <nickc@redhat.com> - 2.35-20
+- Fix excessive memory consumption parsing corrupt DWARF information. (#1947969)
+
+* Fri Mar 26 2021 Nick Clifton  <nickc@redhat.com> - 2.35-19
+- Fix an illegal memory access when using readelf to examine a corrupt file. (#1943534)
+
+* Mon Jan 18 2021 Nick Clifton  <nickc@redhat.com> - 2.35-18
+- Update the GOLD linker to handle x86 .note.gnu.property sections.  (#1916925)
+
+* Thu Jan 14 2021 Nick Clifton  <nickc@redhat.com> - 2.35-17
+- Fix strip when merging multiple same-named sections.  (#1885607)
+
+* Fri Jan 08 2021 Nick Clifton  <nickc@redhat.com> - 2.35-16
+- Fix bug running readelf on an empty file.  (#1903448)
+- Fix bug running readelf on a file that cannot be read.  (#1913589)
+
+* Fri Nov 27 2020 Mark Wielaard  <mjw@fedoraproject.org> - 2.35-15
+- Add DWARF5 fixes from 2_35-branch.
+
+* Fri Oct 30 2020 Nick Clifton  <nickc@redhat.com> - 2.35-14
+- Correction for plugin as-needed patch.  (#1889763)
+
+* Tue Oct 27 2020 Nick Clifton  <nickc@redhat.com> - 2.35-13
+- Really fix erroneous decoding of LEB128 values.  (#1891171)
+
+* Mon Oct 26 2020 Nick Clifton  <nickc@redhat.com> - 2.35-12
+- Fix erroneous decoding of LEB128 values.  (#188716)
+
+* Fri Oct 09 2020 Nick Clifton  <nickc@redhat.com> - 2.35-11
+- Allow plugin syms to mark as-needed shared libs needed
+
 * Fri Jul 31 2020 Jeff Law  <nickc@redhat.com> - 2.35-10
 - Re-enable LTO