Stop a potential call to abort when display the debug information of a corrupt input file. (#2404504 )

Stop a potential illegal memory access when linking a corrupt input file. (#2404553 )
Stop a potential illegal memory access when linking a corrupt input file. (#2402842 )
2025-11-03 13:35:21 +00:00 · 2025-11-03 12:21:45 +00:00 · 2025-10-13 11:43:09 +01:00 · 2025-10-10 13:10:32 +01:00 · 2025-10-03 13:25:34 +01:00 · 2025-10-02 16:04:12 +01:00
15 changed files with 1148 additions and 22 deletions
--- a/binutils-CVE-2025-11082.patch
+++ b/binutils-CVE-2025-11082.patch
@ -0,0 +1,42 @@
+From ea1a0737c7692737a644af0486b71e4a392cbca8 Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Mon, 22 Sep 2025 15:20:34 +0800
+Subject: [PATCH] elf: Don't read beyond .eh_frame section size
+
+	PR ld/33464
+	* elf-eh-frame.c (_bfd_elf_parse_eh_frame): Don't read beyond
+	.eh_frame section size.
+
+Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+---
+ bfd/elf-eh-frame.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff -rup binutils-with-gold-2.44.orig/bfd/elf-eh-frame.c binutils-with-gold-2.44/bfd/elf-eh-frame.c
+--- binutils-with-gold-2.44.orig/bfd/elf-eh-frame.c	2025-10-03 12:07:22.905327392 +0100
+++ binutils-with-gold-2.44/bfd/elf-eh-frame.c	2025-10-03 12:08:02.201129572 +0100
+@@ -735,6 +735,7 @@ _bfd_elf_parse_eh_frame (bfd *abfd, stru
+       if (hdr_id == 0)
+ 	{
+ 	  unsigned int initial_insn_length;
+	  char *null_byte;
+ 
+ 	  /* CIE  */
+ 	  this_inf->cie = 1;
+@@ -751,10 +752,13 @@ _bfd_elf_parse_eh_frame (bfd *abfd, stru
+ 	  REQUIRE (cie->version == 1
+ 		   || cie->version == 3
+ 		   || cie->version == 4);
+-	  REQUIRE (strlen ((char *) buf) < sizeof (cie->augmentation));
+	  null_byte = memchr ((char *) buf, 0, end - buf);
+	  REQUIRE (null_byte != NULL);
+	  REQUIRE ((size_t) (null_byte - (char *) buf)
+		   < sizeof (cie->augmentation));
+ 
+ 	  strcpy (cie->augmentation, (char *) buf);
+-	  buf = (bfd_byte *) strchr ((char *) buf, '\0') + 1;
+	  buf = (bfd_byte *) null_byte + 1;
+ 	  this_inf->u.cie.aug_str_len = buf - start - 1;
+ 	  ENSURE_NO_RELOCS (buf);
+ 	  if (buf[0] == 'e' && buf[1] == 'h')
+Only in binutils-with-gold-2.44/bfd: elf-eh-frame.c.orig
--- a/binutils-CVE-2025-11083.patch
+++ b/binutils-CVE-2025-11083.patch
@ -0,0 +1,76 @@
+From 9ca499644a21ceb3f946d1c179c38a83be084490 Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Thu, 18 Sep 2025 16:59:25 -0700
+Subject: [PATCH] elf: Don't match corrupt section header in linker input
+
+Don't swap in nor match corrupt section header in linker input to avoid
+linker crash later.
+
+	PR ld/33457
+	* elfcode.h (elf_swap_shdr_in): Changed to return bool.  Return
+	false for corrupt section header in linker input.
+	(elf_object_p): Reject if elf_swap_shdr_in returns false.
+
+Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+---
+ bfd/elfcode.h | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/bfd/elfcode.h b/bfd/elfcode.h
+index 9c65852e103..5224a1abee6 100644
+--- a/bfd/elfcode.h
+++ b/bfd/elfcode.h
+@@ -311,7 +311,7 @@ elf_swap_ehdr_out (bfd *abfd,
+ /* Translate an ELF section header table entry in external format into an
+    ELF section header table entry in internal format.  */
+ 
+-static void
+static bool
+ elf_swap_shdr_in (bfd *abfd,
+ 		  const Elf_External_Shdr *src,
+ 		  Elf_Internal_Shdr *dst)
+@@ -341,6 +341,9 @@ elf_swap_shdr_in (bfd *abfd,
+ 	{
+ 	  _bfd_error_handler (_("warning: %pB has a section "
+ 				"extending past end of file"), abfd);
+	  /* PR ld/33457: Don't match corrupt section header.  */
+	  if (abfd->is_linker_input)
+	    return false;
+ 	  abfd->read_only = 1;
+ 	}
+     }
+@@ -350,6 +353,7 @@ elf_swap_shdr_in (bfd *abfd,
+   dst->sh_entsize = H_GET_WORD (abfd, src->sh_entsize);
+   dst->bfd_section = NULL;
+   dst->contents = NULL;
+  return true;
+ }
+ 
+ /* Translate an ELF section header table entry in internal format into an
+@@ -642,9 +646,9 @@ elf_object_p (bfd *abfd)
+ 
+       /* Read the first section header at index 0, and convert to internal
+ 	 form.  */
+-      if (bfd_read (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr))
+      if (bfd_read (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr)
+	  || !elf_swap_shdr_in (abfd, &x_shdr, &i_shdr))
+ 	goto got_no_match;
+-      elf_swap_shdr_in (abfd, &x_shdr, &i_shdr);
+ 
+       /* If the section count is zero, the actual count is in the first
+ 	 section header.  */
+@@ -730,9 +734,9 @@ elf_object_p (bfd *abfd)
+ 	 to internal form.  */
+       for (shindex = 1; shindex < i_ehdrp->e_shnum; shindex++)
+ 	{
+-	  if (bfd_read (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr))
+	  if (bfd_read (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr)
+	      || !elf_swap_shdr_in (abfd, &x_shdr, i_shdrp + shindex))
+ 	    goto got_no_match;
+-	  elf_swap_shdr_in (abfd, &x_shdr, i_shdrp + shindex);
+ 
+ 	  /* Sanity check sh_link and sh_info.  */
+ 	  if (i_shdrp[shindex].sh_link >= num_sec)
+-- 
+2.51.0
+
--- a/binutils-CVE-2025-11494.patch
+++ b/binutils-CVE-2025-11494.patch
@ -0,0 +1,45 @@
+From b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Tue, 30 Sep 2025 08:13:56 +0800
+Subject: [PATCH] x86: Keep _GLOBAL_OFFSET_TABLE_ for .eh_frame
+
+Since x86 .eh_frame section may reference _GLOBAL_OFFSET_TABLE_, keep
+_GLOBAL_OFFSET_TABLE_ if there is dynamic section and the output
+.eh_frame section is non-empty.
+
+	PR ld/33499
+	* elfxx-x86.c (_bfd_x86_elf_late_size_sections): Keep
+	_GLOBAL_OFFSET_TABLE_ if there is dynamic section and the
+	output .eh_frame section is non-empty.
+
+Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+---
+ bfd/elfxx-x86.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff -rup binutils-with-gold-2.44.orig/bfd/elfxx-x86.c binutils-with-gold-2.44/bfd/elfxx-x86.c
+--- binutils-with-gold-2.44.orig/bfd/elfxx-x86.c	2025-10-13 10:42:42.345160623 +0100
+++ binutils-with-gold-2.44/bfd/elfxx-x86.c	2025-10-13 10:42:52.941568120 +0100
+@@ -2458,6 +2458,8 @@ _bfd_x86_elf_late_size_sections (bfd *ou
+ 
+   if (htab->elf.sgotplt)
+     {
+      asection *eh_frame;
+
+       /* Don't allocate .got.plt section if there are no GOT nor PLT
+ 	 entries and there is no reference to _GLOBAL_OFFSET_TABLE_.  */
+       if ((htab->elf.hgot == NULL
+@@ -2470,7 +2472,11 @@ _bfd_x86_elf_late_size_sections (bfd *ou
+ 	  && (htab->elf.iplt == NULL
+ 	      || htab->elf.iplt->size == 0)
+ 	  && (htab->elf.igotplt == NULL
+-	      || htab->elf.igotplt->size == 0))
+	      || htab->elf.igotplt->size == 0)
+	  && (!htab->elf.dynamic_sections_created
+	      || (eh_frame = bfd_get_section_by_name (output_bfd,
+						      ".eh_frame")) == NULL
+	      || eh_frame->rawsize == 0))
+ 	{
+ 	  htab->elf.sgotplt->size = 0;
+ 	  /* Solaris requires to keep _GLOBAL_OFFSET_TABLE_ even if it
+
--- a/binutils-CVE-2025-11495.patch
+++ b/binutils-CVE-2025-11495.patch
@ -0,0 +1,198 @@
+From 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0 Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Tue, 30 Sep 2025 08:18:29 +0800
+Subject: [PATCH] x86: Disallow TLS relocation in non executable section
+
+Since TLS relocations are applied to executable machine instructions,
+disallow TLS relocation in non-SHT_PROGBITS, non-SHF_EXECINSTR section.
+
+	PR ld/33451
+	PR ld/33502
+	* elf32-i386.c (elf_i386_tls_transition): Disallow TLS relocation
+	in non-SHT_PROGBITS, non-SHF_EXECINSTR section.
+	(elf_i386_scan_relocs): Likewise.
+	* elf64-x86-64.c (elf_x86_64_tls_transition): Likewise.
+	(elf_x86_64_scan_relocs): Likewise.
+	* elfxx-x86.c (_bfd_x86_elf_link_report_tls_invalid_section_error):
+	New.
+	* elfxx-x86.h (_bfd_x86_elf_link_report_tls_invalid_section_error):
+	Likewise.
+
+Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+---
+ bfd/elf32-i386.c   | 19 +++++++++++++++++++
+ bfd/elf64-x86-64.c | 20 ++++++++++++++++++++
+ bfd/elfxx-x86.c    | 20 ++++++++++++++++++++
+ bfd/elfxx-x86.h    |  4 ++++
+ 4 files changed, 63 insertions(+)
+
+diff -rup binutils-with-gold-2.44.orig/bfd/elf32-i386.c binutils-with-gold-2.44/bfd/elf32-i386.c
+--- binutils-with-gold-2.44.orig/bfd/elf32-i386.c	2025-10-10 10:27:34.128669391 +0100
+++ binutils-with-gold-2.44/bfd/elf32-i386.c	2025-10-10 10:27:45.159754790 +0100
+@@ -1166,6 +1166,15 @@ elf_i386_tls_transition (struct bfd_link
+       return true;
+     }
+ 
+  if ((elf_section_type (sec) != SHT_PROGBITS
+       || (sec->flags & SEC_CODE) == 0))
+    {
+      reloc_howto_type *howto = elf_i386_rtype_to_howto (from_type);
+      _bfd_x86_elf_link_report_tls_invalid_section_error
+	(abfd, sec, symtab_hdr, h, sym, howto);
+      return false;
+    }
+
+   /* Return TRUE if there is no transition.  */
+   if (from_type == to_type)
+     return true;
+@@ -1685,6 +1694,16 @@ elf_i386_scan_relocs (bfd *abfd,
+ 		tls_type = GOT_TLS_IE_POS; break;
+ 	      }
+ 
+	    if (tls_type >= GOT_TLS_GD
+		&& tls_type <= GOT_TLS_GDESC
+		&& (elf_section_type (sec) != SHT_PROGBITS
+		    || (sec->flags & SEC_CODE) == 0))
+	      {
+		_bfd_x86_elf_link_report_tls_invalid_section_error
+		  (abfd, sec, symtab_hdr, h, isym, howto);
+		goto error_return;
+	      }
+
+ 	    if (h != NULL)
+ 	      {
+ 		h->got.refcount = 1;
+diff -rup binutils-with-gold-2.44.orig/bfd/elf64-x86-64.c binutils-with-gold-2.44/bfd/elf64-x86-64.c
+--- binutils-with-gold-2.44.orig/bfd/elf64-x86-64.c	2025-10-10 10:27:34.147669538 +0100
+++ binutils-with-gold-2.44/bfd/elf64-x86-64.c	2025-10-10 10:27:45.161165453 +0100
+@@ -1598,6 +1598,16 @@ elf_x86_64_tls_transition (struct bfd_li
+       return true;
+     }
+ 
+  if ((elf_section_type (sec) != SHT_PROGBITS
+       || (sec->flags & SEC_CODE) == 0))
+    {
+      reloc_howto_type *howto = elf_x86_64_rtype_to_howto (abfd,
+							   from_type);
+      _bfd_x86_elf_link_report_tls_invalid_section_error
+	(abfd, sec, symtab_hdr, h, sym, howto);
+      return false;
+    }
+
+   /* Return TRUE if there is no transition.  */
+   if (from_type == to_type
+       || (from_type == R_X86_64_CODE_4_GOTTPOFF
+@@ -2351,6 +2361,16 @@ elf_x86_64_scan_relocs (bfd *abfd, struc
+ 		break;
+ 	      }
+ 
+	    if (tls_type >= GOT_TLS_GD
+		&& tls_type <= GOT_TLS_GDESC
+		&& (elf_section_type (sec) != SHT_PROGBITS
+		    || (sec->flags & SEC_CODE) == 0))
+	      {
+		_bfd_x86_elf_link_report_tls_invalid_section_error
+		  (abfd, sec, symtab_hdr, h, isym, howto);
+		goto error_return;
+	      }
+
+ 	    if (h != NULL)
+ 	      {
+ 		h->got.refcount = 1;
+diff -rup binutils-with-gold-2.44.orig/bfd/elfxx-x86.c binutils-with-gold-2.44/bfd/elfxx-x86.c
+--- binutils-with-gold-2.44.orig/bfd/elfxx-x86.c	2025-10-10 10:27:34.204669979 +0100
+++ binutils-with-gold-2.44/bfd/elfxx-x86.c	2025-10-10 10:27:45.161625095 +0100
+@@ -3359,6 +3359,26 @@ _bfd_x86_elf_link_report_tls_transition_
+   bfd_set_error (bfd_error_bad_value);
+ }
+ 
+/* Report TLS invalid section error.  */
+
+void
+_bfd_x86_elf_link_report_tls_invalid_section_error
+  (bfd *abfd, asection *sec, Elf_Internal_Shdr *symtab_hdr,
+   struct elf_link_hash_entry *h, Elf_Internal_Sym *sym,
+   reloc_howto_type *howto)
+{
+  const char *name;
+  if (h)
+    name = h->root.root.string;
+  else
+    name = bfd_elf_sym_name (abfd, symtab_hdr, sym, NULL);
+  _bfd_error_handler
+    /* xgettext:c-format */
+    (_("%pB: relocation %s against thread local symbol `%s' in "
+       "invalid section `%pA'"), abfd, howto->name, name, sec);
+  bfd_set_error (bfd_error_bad_value);
+}
+
+ /* Return TRUE if symbol should be hashed in the `.gnu.hash' section.  */
+ 
+ bool
+diff -rup binutils-with-gold-2.44.orig/bfd/elfxx-x86.h binutils-with-gold-2.44/bfd/elfxx-x86.h
+--- binutils-with-gold-2.44.orig/bfd/elfxx-x86.h	2025-10-10 10:27:34.157669616 +0100
+++ binutils-with-gold-2.44/bfd/elfxx-x86.h	2025-10-10 10:27:45.162048003 +0100
+@@ -939,6 +939,10 @@ extern void _bfd_x86_elf_link_report_tls
+    const Elf_Internal_Rela *, const char *, const char *,
+    enum elf_x86_tls_error_type);
+ 
+extern void _bfd_x86_elf_link_report_tls_invalid_section_error
+  (bfd *, asection *, Elf_Internal_Shdr *, struct elf_link_hash_entry *,
+   Elf_Internal_Sym *, reloc_howto_type *);
+
+ #define bfd_elf64_mkobject \
+   _bfd_x86_elf_mkobject
+ #define bfd_elf32_mkobject \
+--- binutils-with-gold-2.44.orig/bfd/elf64-x86-64.c	2025-10-10 10:58:00.684202576 +0100
+++ binutils-with-gold-2.44/bfd/elf64-x86-64.c	2025-10-10 11:01:54.310462809 +0100
+@@ -2169,6 +2169,7 @@ elf_x86_64_scan_relocs (bfd *abfd, struc
+       bool size_reloc;
+       bool converted_reloc;
+       bool no_dynreloc;
+      reloc_howto_type *howto;
+ 
+       r_symndx = htab->r_sym (rel->r_info);
+       r_type = ELF32_R_TYPE (rel->r_info);
+@@ -2185,6 +2186,14 @@ elf_x86_64_scan_relocs (bfd *abfd, struc
+ 	  goto error_return;
+ 	}
+ 
+      howto = elf_x86_64_rtype_to_howto (abfd, r_type);
+      if (howto == NULL)
+	{
+	  _bfd_error_handler (_("%pB: unsupported relocation type %#x"),
+			      abfd, r_type);
+	  goto error_return;
+	}
+
+       if (r_symndx < symtab_hdr->sh_info)
+ 	{
+ 	  /* A local symbol.  */
+--- binutils-with-gold-2.44.orig/bfd/elf32-i386.c	2025-10-10 11:05:23.893062517 +0100
+++ binutils-with-gold-2.44/bfd/elf32-i386.c	2025-10-10 11:06:31.136544677 +0100
+@@ -1540,6 +1540,7 @@ elf_i386_scan_relocs (bfd *abfd,
+       const char *name;
+       bool size_reloc;
+       bool no_dynreloc;
+      reloc_howto_type *howto;
+ 
+       r_symndx = ELF32_R_SYM (rel->r_info);
+       r_type = ELF32_R_TYPE (rel->r_info);
+@@ -1556,6 +1557,17 @@ elf_i386_scan_relocs (bfd *abfd,
+ 	  goto error_return;
+ 	}
+ 
+      howto = elf_i386_rtype_to_howto (r_type);
+      if (rel->r_offset + bfd_get_reloc_size (howto) > sec->size)
+	{
+	  /* xgettext:c-format */
+	  _bfd_error_handler
+	    (_("%pB: bad reloc offset (%#" PRIx32 " > %#" PRIx32 ") for"
+	       " section `%pA'"), abfd, (uint32_t) rel->r_offset,
+	     (uint32_t) sec->size, sec);
+	  goto error_return;
+	}
+
+       if (r_symndx < symtab_hdr->sh_info)
+ 	{
+ 	  /* A local symbol.  */
--- a/binutils-CVE-2025-11839.patch
+++ b/binutils-CVE-2025-11839.patch
@ -0,0 +1,27 @@
+From 12ef7d5b7b02d0023db645d86eb9d0797bc747fe Mon Sep 17 00:00:00 2001
+From: Nick Clifton <nickc@redhat.com>
+Date: Mon, 3 Nov 2025 11:49:02 +0000
+Subject: [PATCH] Remove call to abort in the DGB debug format printing code,
+ thus allowing the display of a fuzzed input file to complete without
+ triggering an abort.
+
+PR 33448
+---
+ binutils/prdbg.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/binutils/prdbg.c b/binutils/prdbg.c
+index c239aeb1a79..5d405c48e3d 100644
+--- a/binutils/prdbg.c
+++ b/binutils/prdbg.c
+@@ -2449,7 +2449,6 @@ tg_tag_type (void *p, const char *name, unsigned int id,
+       t = "union class ";
+       break;
+     default:
+-      abort ();
+       return false;
+     }
+ 
+-- 
+2.51.1
+
--- a/binutils-CVE-2025-11840.patch
+++ b/binutils-CVE-2025-11840.patch
@ -0,0 +1,24 @@
+From f6b0f53a36820da91eadfa9f466c22f92e4256e0 Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Mon, 3 Nov 2025 09:03:37 +1030
+Subject: [PATCH] PR 33455 SEGV in vfinfo at ldmisc.c:527
+
+A reloc howto set up with EMPTY_HOWTO has a NULL name.  More than one
+place emitting diagnostics assumes a reloc howto won't have a NULL
+name.
+
+	PR 33455
+	* coffcode.h (coff_slurp_reloc_table): Don't allow a howto with
+	a NULL name.
+---
+--- binutils-2.43.1.orig/bfd/coffcode.h	2025-11-03 11:17:09.463206752 +0000
+++ binutils-2.43.1/bfd/coffcode.h	2025-11-03 11:17:21.031291895 +0000
+@@ -5347,7 +5347,7 @@ coff_slurp_reloc_table (bfd * abfd, sec_
+       RTYPE2HOWTO (cache_ptr, &dst);
+ #endif	/* RELOC_PROCESSING */
+ 
+-      if (cache_ptr->howto == NULL)
+      if (cache_ptr->howto == NULL || cache_ptr->howto->name == NULL)
+ 	{
+ 	  _bfd_error_handler
+ 	    /* xgettext:c-format */
--- a/binutils-CVE-2025-7545.patch
+++ b/binutils-CVE-2025-7545.patch
@ -0,0 +1,38 @@
+From 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944 Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Sat, 21 Jun 2025 06:36:56 +0800
+Subject: [PATCH] objcopy: Don't extend the output section size
+
+Since the output section contents are copied from the input, don't
+extend the output section size beyond the input section size.
+
+	PR binutils/33049
+	* objcopy.c (copy_section): Don't extend the output section
+	size beyond the input section size.
+
+Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+---
+diff -rup binutils-with-gold-2.44.orig/binutils/objcopy.c binutils-with-gold-2.44/binutils/objcopy.c
+--- binutils-with-gold-2.44.orig/binutils/objcopy.c	2025-07-14 14:02:26.056738993 +0100
+++ binutils-with-gold-2.44/binutils/objcopy.c	2025-07-14 14:02:37.994817061 +0100
+@@ -4634,6 +4634,7 @@ copy_section (bfd *ibfd, sec_ptr isectio
+ 	  char *to = (char *) memhunk;
+ 	  char *end = (char *) memhunk + size;
+ 	  int i;
+	  bfd_size_type memhunk_size = size;
+ 
+ 	  /* If the section address is not exactly divisible by the interleave,
+ 	     then we must bias the from address.  If the copy_byte is less than
+@@ -4653,6 +4654,11 @@ copy_section (bfd *ibfd, sec_ptr isectio
+ 	      }
+ 
+ 	  size = (size + interleave - 1 - copy_byte) / interleave * copy_width;
+
+	  /* Don't extend the output section size.  */
+	  if (size > memhunk_size)
+	    size = memhunk_size;
+
+ 	  osection->lma /= interleave;
+ 	  if (copy_byte < extra)
+ 	    osection->lma++;
+Only in binutils-with-gold-2.44/binutils: objcopy.c.orig
--- a/binutils-CVE-2025-7546.patch
+++ b/binutils-CVE-2025-7546.patch
@ -0,0 +1,48 @@
+From 41461010eb7c79fee7a9d5f6209accdaac66cc6b Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Sat, 21 Jun 2025 06:52:00 +0800
+Subject: [PATCH] elf: Report corrupted group section
+
+Report corrupted group section instead of trying to recover.
+
+	PR binutils/33050
+	* elf.c (bfd_elf_set_group_contents): Report corrupted group
+	section.
+
+Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+---
+diff -rup binutils-with-gold-2.44.orig/bfd/elf.c binutils-with-gold-2.44/bfd/elf.c
+--- binutils-with-gold-2.44.orig/bfd/elf.c	2025-07-14 14:02:25.953738320 +0100
+++ binutils-with-gold-2.44/bfd/elf.c	2025-07-14 14:03:26.748082669 +0100
+@@ -3943,20 +3943,17 @@ bfd_elf_set_group_contents (bfd *abfd, a
+ 	break;
+     }
+ 
+-  /* We should always get here with loc == sec->contents + 4, but it is
+-     possible to craft bogus SHT_GROUP sections that will cause segfaults
+-     in objcopy without checking loc here and in the loop above.  */
+-  if (loc == sec->contents)
+-    BFD_ASSERT (0);
+-  else
+  /* We should always get here with loc == sec->contents + 4.  Return
+     an error for bogus SHT_GROUP sections.  */
+  loc -= 4;
+  if (loc != sec->contents)
+     {
+-      loc -= 4;
+-      if (loc != sec->contents)
+-	{
+-	  BFD_ASSERT (0);
+-	  memset (sec->contents + 4, 0, loc - sec->contents);
+-	  loc = sec->contents;
+-	}
+      /* xgettext:c-format */
+      _bfd_error_handler (_("%pB: corrupted group section: `%pA'"),
+			  abfd, sec);
+      bfd_set_error (bfd_error_bad_value);
+      *failedptr = true;
+      return;
+     }
+ 
+   H_PUT_32 (abfd, sec->flags & SEC_LINK_ONCE ? GRP_COMDAT : 0, loc);
+Only in binutils-with-gold-2.44/bfd: elf.c.orig
--- a/binutils-CVE-2025-8224.patch
+++ b/binutils-CVE-2025-8224.patch
@ -0,0 +1,14 @@
+--- binutils-with-gold-2.44.orig/binutils/dwarf.c	2025-07-29 13:59:16.790021400 +0100
+++ binutils-with-gold-2.44/binutils/dwarf.c	2025-07-29 14:00:52.519441392 +0100
+@@ -3807,10 +3807,9 @@ process_debug_info (struct dwarf_section
+     }
+ 
+   if ((do_loc || do_debug_loc || do_debug_ranges || do_debug_info)
+-      && num_debug_info_entries == 0
+      && alloc_num_debug_info_entries == 0
+       && ! do_types)
+     {
+-
+       /* Then allocate an array to hold the information.  */
+       debug_information = (debug_info *) cmalloc (num_units,
+ 						  sizeof (* debug_information));
--- a/binutils-aarch64-small-plt0.patch
+++ b/binutils-aarch64-small-plt0.patch
@ -0,0 +1,12 @@
+--- binutils.orig/bfd/elfnn-aarch64.c	2025-02-07 13:42:20.961333141 +0000
+++ binutils-with-gold-2.44/bfd/elfnn-aarch64.c	2025-02-07 13:42:29.781353740 +0000
+@@ -10162,7 +10162,8 @@ elfNN_aarch64_init_small_plt0_entry (bfd
+   /* PR 26312: Explicitly set the sh_entsize to 0 so that
+      consumers do not think that the section contains fixed
+      sized objects.  */
+-  elf_section_data (htab->root.splt->output_section)->this_hdr.sh_entsize = 0;
+  if (elf_section_data (htab->root.splt->output_section) != NULL)
+    elf_section_data (htab->root.splt->output_section)->this_hdr.sh_entsize = 0;
+ 
+   plt_got_2nd_ent = (htab->root.sgotplt->output_section->vma
+ 		  + htab->root.sgotplt->output_offset
--- a/binutils-disable-gcs-report-dynamic-tests.patch
+++ b/binutils-disable-gcs-report-dynamic-tests.patch
@ -0,0 +1,413 @@
+From 9e7085f2700d698dfbb37aef24c0489c2d09a978 Mon Sep 17 00:00:00 2001
+From: Siddhesh Poyarekar <siddhesh@gotplt.org>
+Date: Thu, 6 Feb 2025 12:06:27 -0500
+Subject: [PATCH] Revert "aarch64: GCS tests for linking issues with dynamic
+ objects"
+
+This reverts commit 1c136b8ee9b9fb402b66957bd51e89e47b94a0f6.
+---
+ .../protections/aarch64-protections.exp       | 15 ----------
+ .../ld-aarch64/protections/gcs-dynamic-1-a.d  | 12 --------
+ .../ld-aarch64/protections/gcs-dynamic-1-b.d  | 12 --------
+ .../protections/gcs-dynamic-2-a-i.d           | 15 ----------
+ .../protections/gcs-dynamic-2-a-ii.d          |  8 ------
+ .../protections/gcs-dynamic-2-a-iii.d         | 15 ----------
+ .../protections/gcs-dynamic-2-a-iv.d          | 12 --------
+ .../ld-aarch64/protections/gcs-dynamic-2-b.d  | 14 ----------
+ .../ld-aarch64/protections/gcs-dynamic-2-c.d  | 12 --------
+ .../ld-aarch64/protections/gcs-dynamic-2-d.d  | 14 ----------
+ .../ld-aarch64/protections/gcs-dynamic-3-a.d  | 15 ----------
+ .../ld-aarch64/protections/gcs-dynamic-3-b.d  | 14 ----------
+ .../ld-aarch64/protections/gcs-dynamic-3-c.d  | 12 --------
+ .../ld-aarch64/protections/gcs-dynamic-4-a.d  |  7 -----
+ .../ld-aarch64/protections/gcs-dynamic-4-b.d  |  7 -----
+ .../ld-aarch64/protections/gcs-dynamic-4-c.d  |  7 -----
+ ld/testsuite/ld-aarch64/protections/gcs-so.s  | 28 -------------------
+ ld/testsuite/ld-aarch64/protections/gcs-so2.s | 28 -------------------
+ 18 files changed, 247 deletions(-)
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-1-a.d
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-1-b.d
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-i.d
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-ii.d
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-iii.d
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-iv.d
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-b.d
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-c.d
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-d.d
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-3-a.d
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-3-b.d
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-3-c.d
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-4-a.d
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-4-b.d
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-4-c.d
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-so.s
+ delete mode 100644 ld/testsuite/ld-aarch64/protections/gcs-so2.s
+
+diff --git a/ld/testsuite/ld-aarch64/protections/aarch64-protections.exp b/ld/testsuite/ld-aarch64/protections/aarch64-protections.exp
+index cf0f03daee6..b49428d1039 100644
+--- a/ld/testsuite/ld-aarch64/protections/aarch64-protections.exp
+++ b/ld/testsuite/ld-aarch64/protections/aarch64-protections.exp
+@@ -42,21 +42,6 @@ set aarch64elflinktests {
+    "-shared" ""
+    "-I$srcdir/$subdir -defsym __property_bti__=1"
+    {bti-plt-so.s} {} "libbti-plt-so.so"}
+-
+-  {"Build gcs-so for GCS tests"
+-   "-shared" ""
+-   "-I$srcdir/$subdir -defsym __property_gcs__=1"
+-   {gcs-so.s} {} "libgcs-so.so"}
+-
+-  {"Build nogcs-so for GCS tests"
+-   "-shared" ""
+-   "-I$srcdir/$subdir"
+-   {gcs-so.s} {} "libnogcs-so.so"}
+-
+-  {"Build gcs-so2 for GCS tests"
+-   "-shared" ""
+-   "-I$srcdir/$subdir -defsym __property_gcs__=1"
+-   {gcs-so2.s} {} "libgcs-so2.so"}
+ }
+ 
+ if [check_shared_lib_support] {
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-1-a.d b/ld/testsuite/ld-aarch64/protections/gcs-dynamic-1-a.d
+deleted file mode 100644
+index be8a301f6c0..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-1-a.d
+++ /dev/null
+@@ -1,12 +0,0 @@
+-#name: '-z gcs=always -z gcs-report=error' and shared library with GCS feature reports no error.
+-#source: gcs.s
+-#source: gcs2.s
+-#alltargets: [check_shared_lib_support] *linux*
+-#as: -march=armv9.4-a+gcs -defsym __property_gcs__=1
+-#ld: -z gcs=always -z gcs-report=error -L./tmpdir -lgcs-so
+-#readelf: -n
+-
+-Displaying notes found in: .note.gnu.property
+-[ 	]+Owner[ 	]+Data size[ 	]+Description
+-  GNU                  0x00000010	NT_GNU_PROPERTY_TYPE_0
+-      Properties: AArch64 feature: GCS
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-1-b.d b/ld/testsuite/ld-aarch64/protections/gcs-dynamic-1-b.d
+deleted file mode 100644
+index d53d45ae598..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-1-b.d
+++ /dev/null
+@@ -1,12 +0,0 @@
+-#name: '-z gcs=always -z gcs-report=error -z gcs-report-dynamic=error' and shared library with GCS feature reports no error.
+-#source: gcs.s
+-#source: gcs2.s
+-#alltargets: [check_shared_lib_support] *linux*
+-#as: -march=armv9.4-a+gcs -defsym __property_gcs__=1
+-#ld: -z gcs=always -z gcs-report=error -z gcs-report-dynamic=error -L./tmpdir -lgcs-so
+-#readelf: -n
+-
+-Displaying notes found in: .note.gnu.property
+-[ 	]+Owner[ 	]+Data size[ 	]+Description
+-  GNU                  0x00000010	NT_GNU_PROPERTY_TYPE_0
+-      Properties: AArch64 feature: GCS
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-i.d b/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-i.d
+deleted file mode 100644
+index 903d14099be..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-i.d
+++ /dev/null
+@@ -1,15 +0,0 @@
+-#name: '-z gcs=always -z gcs-report=error' and shared libraries without GCS feature reports warnings.
+-#source: gcs.s
+-#source: gcs2.s
+-#alltargets: [check_shared_lib_support] *linux*
+-#as: -march=armv9.4-a+gcs  -defsym __property_gcs__=1
+-#ld: -z gcs=always -z gcs-report=error -L./tmpdir -lnogcs-so -lbti-plt-so -lgcs-so2
+-#warning: \A[^\n]*libnogcs-so\.so: warning: GCS is required by -z gcs[^\n]*\n
+-#warning:   [^\n]*libbti-plt-so\.so: warning: GCS is required by -z gcs[^\n]*
+-
+-#readelf: -n
+-
+-Displaying notes found in: .note.gnu.property
+-[ 	]+Owner[ 	]+Data size[ 	]+Description
+-  GNU                  0x00000010	NT_GNU_PROPERTY_TYPE_0
+-      Properties: AArch64 feature: GCS
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-ii.d b/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-ii.d
+deleted file mode 100644
+index 7adb481bc30..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-ii.d
+++ /dev/null
+@@ -1,8 +0,0 @@
+-#name: '-z gcs=always -z gcs-report=error -z gcs-report-dynamic=error' and shared libraries without GCS feature reports errors.
+-#source: gcs.s
+-#source: gcs2.s
+-#alltargets: [check_shared_lib_support] *linux*
+-#as: -march=armv9.4-a+gcs  -defsym __property_gcs__=1
+-#ld: -z gcs=always -z gcs-report=error -z gcs-report-dynamic=error -L./tmpdir -lnogcs-so -lbti-plt-so -lgcs-so2
+-#error: \A[^\n]*libnogcs-so\.so: error: GCS is required by -z gcs[^\n]*\n
+-#error:   [^\n]*libbti-plt-so\.so: error: GCS is required by -z gcs[^\n]*
+\ No newline at end of file
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-iii.d b/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-iii.d
+deleted file mode 100644
+index 76a7c461347..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-iii.d
+++ /dev/null
+@@ -1,15 +0,0 @@
+-#name: '-z gcs=always -z gcs-report=error -z gcs-report-dynamic=warning' and shared libraries without GCS feature reports warnings.
+-#source: gcs.s
+-#source: gcs2.s
+-#alltargets: [check_shared_lib_support] *linux*
+-#as: -march=armv9.4-a+gcs  -defsym __property_gcs__=1
+-#ld: -z gcs=always -z gcs-report=error -z gcs-report-dynamic=warning -L./tmpdir -lnogcs-so -lbti-plt-so -lgcs-so2
+-#warning: \A[^\n]*libnogcs-so\.so: warning: GCS is required by -z gcs[^\n]*\n
+-#warning:   [^\n]*libbti-plt-so\.so: warning: GCS is required by -z gcs[^\n]*
+-
+-#readelf: -n
+-
+-Displaying notes found in: .note.gnu.property
+-[ 	]+Owner[ 	]+Data size[ 	]+Description
+-  GNU                  0x00000010	NT_GNU_PROPERTY_TYPE_0
+-      Properties: AArch64 feature: GCS
+\ No newline at end of file
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-iv.d b/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-iv.d
+deleted file mode 100644
+index 554ca1186ef..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-iv.d
+++ /dev/null
+@@ -1,12 +0,0 @@
+-#name: '-z gcs=always -z gcs-report=error -z gcs-report-dynamic=none' and shared libraries without GCS feature reports nothing.
+-#source: gcs.s
+-#source: gcs2.s
+-#alltargets: [check_shared_lib_support] *linux*
+-#as: -march=armv9.4-a+gcs  -defsym __property_gcs__=1
+-#ld: -z gcs=always -z gcs-report=error -z gcs-report-dynamic=none -L./tmpdir -lnogcs-so -lbti-plt-so -lgcs-so2
+-#readelf: -n
+-
+-Displaying notes found in: .note.gnu.property
+-[ 	]+Owner[ 	]+Data size[ 	]+Description
+-  GNU                  0x00000010	NT_GNU_PROPERTY_TYPE_0
+-      Properties: AArch64 feature: GCS
+\ No newline at end of file
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-b.d b/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-b.d
+deleted file mode 100644
+index 36262bbc087..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-b.d
+++ /dev/null
+@@ -1,14 +0,0 @@
+-#name: '-z gcs=always -z gcs-report=warning' and shared libraries without GCS feature reports warnings.
+-#source: gcs.s
+-#source: gcs2.s
+-#alltargets: [check_shared_lib_support] *linux*
+-#as: -march=armv9.4-a+gcs  -defsym __property_gcs__=1
+-#ld: -z gcs=always -z gcs-report=warning -L./tmpdir -lnogcs-so -lbti-plt-so -lgcs-so2
+-#warning: \A[^\n]*libnogcs-so\.so: warning: GCS is required by -z gcs[^\n]*\n
+-#warning:   [^\n]*libbti-plt-so\.so: warning: GCS is required by -z gcs[^\n]*
+-#readelf: -n
+-
+-Displaying notes found in: .note.gnu.property
+-[ 	]+Owner[ 	]+Data size[ 	]+Description
+-  GNU                  0x00000010	NT_GNU_PROPERTY_TYPE_0
+-      Properties: AArch64 feature: GCS
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-c.d b/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-c.d
+deleted file mode 100644
+index 6c7f5da8be7..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-c.d
+++ /dev/null
+@@ -1,12 +0,0 @@
+-#name: '-z gcs=always -z gcs-report=none' and shared libraries without GCS feature reports nothing.
+-#source: gcs.s
+-#source: gcs2.s
+-#alltargets: [check_shared_lib_support] *linux*
+-#as: -march=armv9.4-a+gcs  -defsym __property_gcs__=1
+-#ld: -z gcs=always -z gcs-report=none -L./tmpdir -lnogcs-so -lbti-plt-so -lgcs-so2
+-#readelf: -n
+-
+-Displaying notes found in: .note.gnu.property
+-[ 	]+Owner[ 	]+Data size[ 	]+Description
+-  GNU                  0x00000010	NT_GNU_PROPERTY_TYPE_0
+-      Properties: AArch64 feature: GCS
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-d.d b/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-d.d
+deleted file mode 100644
+index 58498e6c00b..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-d.d
+++ /dev/null
+@@ -1,14 +0,0 @@
+-#name: '-z gcs=always -z gcs-report' and shared libraries without GCS feature reports warnings.
+-#source: gcs.s
+-#source: gcs2.s
+-#alltargets: [check_shared_lib_support] *linux*
+-#as: -march=armv9.4-a+gcs  -defsym __property_gcs__=1
+-#ld: -z gcs=always -z gcs-report -L./tmpdir -lnogcs-so -lbti-plt-so -lgcs-so2
+-#warning: \A[^\n]*libnogcs-so\.so: warning: GCS is required by -z gcs[^\n]*\n
+-#warning:   [^\n]*libbti-plt-so\.so: warning: GCS is required by -z gcs[^\n]*
+-#readelf: -n
+-
+-Displaying notes found in: .note.gnu.property
+-[ 	]+Owner[ 	]+Data size[ 	]+Description
+-  GNU                  0x00000010	NT_GNU_PROPERTY_TYPE_0
+-      Properties: AArch64 feature: GCS
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-3-a.d b/ld/testsuite/ld-aarch64/protections/gcs-dynamic-3-a.d
+deleted file mode 100644
+index ecdaf526779..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-3-a.d
+++ /dev/null
+@@ -1,15 +0,0 @@
+-#name: '-z gcs=implicit -z gcs-report=error' and shared libraries without GCS feature reports warnings.
+-#source: gcs.s
+-#source: gcs2.s
+-#alltargets: [check_shared_lib_support] *linux*
+-#as: -march=armv9.4-a+gcs  -defsym __property_gcs__=1
+-#ld: -z gcs=implicit -z gcs-report=error -L./tmpdir -lnogcs-so -lbti-plt-so -lgcs-so2
+-#warning: \A[^\n]*libnogcs-so\.so: warning: GCS is required by -z gcs[^\n]*\n
+-#warning:   [^\n]*libbti-plt-so\.so: warning: GCS is required by -z gcs[^\n]*
+-
+-#readelf: -n
+-
+-Displaying notes found in: .note.gnu.property
+-[ 	]+Owner[ 	]+Data size[ 	]+Description
+-  GNU                  0x00000010	NT_GNU_PROPERTY_TYPE_0
+-      Properties: AArch64 feature: GCS
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-3-b.d b/ld/testsuite/ld-aarch64/protections/gcs-dynamic-3-b.d
+deleted file mode 100644
+index 4d32fb6aa54..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-3-b.d
+++ /dev/null
+@@ -1,14 +0,0 @@
+-#name: '-z gcs=implicit -z gcs-report=warning' and shared libraries without GCS feature reports warnings.
+-#source: gcs.s
+-#source: gcs2.s
+-#alltargets: [check_shared_lib_support] *linux*
+-#as: -march=armv9.4-a+gcs  -defsym __property_gcs__=1
+-#ld: -z gcs=implicit -z gcs-report=warning -L./tmpdir -lnogcs-so -lbti-plt-so -lgcs-so2
+-#warning: \A[^\n]*libnogcs-so\.so: warning: GCS is required by -z gcs[^\n]*\n
+-#warning:   [^\n]*libbti-plt-so\.so: warning: GCS is required by -z gcs[^\n]*
+-#readelf: -n
+-
+-Displaying notes found in: .note.gnu.property
+-[ 	]+Owner[ 	]+Data size[ 	]+Description
+-  GNU                  0x00000010	NT_GNU_PROPERTY_TYPE_0
+-      Properties: AArch64 feature: GCS
+\ No newline at end of file
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-3-c.d b/ld/testsuite/ld-aarch64/protections/gcs-dynamic-3-c.d
+deleted file mode 100644
+index c0da6c1d9c6..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-3-c.d
+++ /dev/null
+@@ -1,12 +0,0 @@
+-#name: '-z gcs=implicit -z gcs-report=none' and shared libraries without GCS feature reports no warning.
+-#source: gcs.s
+-#source: gcs2.s
+-#alltargets: [check_shared_lib_support] *linux*
+-#as: -march=armv9.4-a+gcs  -defsym __property_gcs__=1
+-#ld: -z gcs=implicit -z gcs-report=none -L./tmpdir -lnogcs-so -lbti-plt-so -lgcs-so2
+-#readelf: -n
+-
+-Displaying notes found in: .note.gnu.property
+-[ 	]+Owner[ 	]+Data size[ 	]+Description
+-  GNU                  0x00000010	NT_GNU_PROPERTY_TYPE_0
+-      Properties: AArch64 feature: GCS
+\ No newline at end of file
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-4-a.d b/ld/testsuite/ld-aarch64/protections/gcs-dynamic-4-a.d
+deleted file mode 100644
+index ae324bbba1e..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-4-a.d
+++ /dev/null
+@@ -1,7 +0,0 @@
+-#name: '-z gcs=never -z gcs-report=error' and shared libraries without GCS feature reports no warning/error.
+-#source: gcs.s
+-#source: gcs2.s
+-#alltargets: [check_shared_lib_support] *linux*
+-#as: -march=armv9.4-a+gcs  -defsym __property_gcs__=1
+-#ld: -z gcs=never -z gcs-report=error -L./tmpdir -lnogcs-so -lbti-plt-so -lgcs-so2
+-#readelf: -n
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-4-b.d b/ld/testsuite/ld-aarch64/protections/gcs-dynamic-4-b.d
+deleted file mode 100644
+index 6b65898b924..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-4-b.d
+++ /dev/null
+@@ -1,7 +0,0 @@
+-#name: '-z gcs=never -z gcs-report=warning' and shared libraries without GCS feature reports no warning/error.
+-#source: gcs.s
+-#source: gcs2.s
+-#alltargets: [check_shared_lib_support] *linux*
+-#as: -march=armv9.4-a+gcs  -defsym __property_gcs__=1
+-#ld: -z gcs=never -z gcs-report=warning -L./tmpdir -lnogcs-so -lbti-plt-so -lgcs-so2
+-#readelf: -n
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-4-c.d b/ld/testsuite/ld-aarch64/protections/gcs-dynamic-4-c.d
+deleted file mode 100644
+index 35b011f6a8e..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-dynamic-4-c.d
+++ /dev/null
+@@ -1,7 +0,0 @@
+-#name: '-z gcs=never -z gcs-report=none' and shared libraries without GCS feature reports no warning/error.
+-#source: gcs.s
+-#source: gcs2.s
+-#alltargets: [check_shared_lib_support] *linux*
+-#as: -march=armv9.4-a+gcs  -defsym __property_gcs__=1
+-#ld: -z gcs=never -z gcs-report=none -L./tmpdir -lnogcs-so -lbti-plt-so -lgcs-so2
+-#readelf: -n
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-so.s b/ld/testsuite/ld-aarch64/protections/gcs-so.s
+deleted file mode 100644
+index aa6485b9dde..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-so.s
+++ /dev/null
+@@ -1,28 +0,0 @@
+-	.global	foo2
+-	.type	foo2, %function
+-foo2:
+-	sub	sp, sp, #16
+-	mov	w0, 9
+-	str	w0, [sp, 12]
+-	ldr	w0, [sp, 12]
+-	add	w0, w0, 4
+-	str	w0, [sp, 12]
+-	nop
+-	add	sp, sp, 16
+-	ret
+-	.size	foo2, .-foo2
+-	.global	bar2
+-	.type	bar2, %function
+-bar2:
+-	sub	sp, sp, #16
+-	mov	w0, 9
+-	str	w0, [sp, 12]
+-	ldr	w0, [sp, 12]
+-	add	w0, w0, 4
+-	str	w0, [sp, 12]
+-	nop
+-	add	sp, sp, 16
+-	ret
+-	.size	bar2, .-bar2
+-
+-.include "gnu-note-properties-selectable-merged.inc"
+diff --git a/ld/testsuite/ld-aarch64/protections/gcs-so2.s b/ld/testsuite/ld-aarch64/protections/gcs-so2.s
+deleted file mode 100644
+index 938ba43c69c..00000000000
+--- a/ld/testsuite/ld-aarch64/protections/gcs-so2.s
+++ /dev/null
+@@ -1,28 +0,0 @@
+-	.global	foo3
+-	.type	foo3, %function
+-foo3:
+-	sub	sp, sp, #16
+-	mov	w0, 9
+-	str	w0, [sp, 12]
+-	ldr	w0, [sp, 12]
+-	add	w0, w0, 4
+-	str	w0, [sp, 12]
+-	nop
+-	add	sp, sp, 16
+-	ret
+-	.size	foo3, .-foo3
+-	.global	bar3
+-	.type	bar3, %function
+-bar3:
+-	sub	sp, sp, #16
+-	mov	w0, 9
+-	str	w0, [sp, 12]
+-	ldr	w0, [sp, 12]
+-	add	w0, w0, 4
+-	str	w0, [sp, 12]
+-	nop
+-	add	sp, sp, 16
+-	ret
+-	.size	bar3, .-bar3
+-
+-.include "gnu-note-properties-selectable-merged.inc"
+-- 
+2.48.1
+
--- a/binutils-disable-gcs-report-dynamic.patch
+++ b/binutils-disable-gcs-report-dynamic.patch
@ -0,0 +1,17 @@
+diff -pruN a/bfd/elfnn-aarch64.c b/bfd/elfnn-aarch64.c
+--- a/bfd/elfnn-aarch64.c	2025-02-06 10:39:49.722259921 -0500
+++ b/bfd/elfnn-aarch64.c	2025-02-06 10:47:28.604658973 -0500
+@@ -5051,11 +5051,10 @@ bfd_elfNN_aarch64_set_options (struct bf
+      libraries.  If a user also wants to error GCS issues in the shared
+      libraries, '-z gcs-report-dynamic=error' will have to be specified
+      explicitly.  */
+  /* XXX Fedora override: default to NONE.  */
+   if (sw_protections->gcs_report_dynamic == MARKING_UNSET)
+     elf_aarch64_tdata (output_bfd)->sw_protections.gcs_report_dynamic
+-      = (sw_protections->gcs_report == MARKING_ERROR)
+-      ? MARKING_WARN
+-      : sw_protections->gcs_report;
+      =  MARKING_NONE;
+ 
+   elf_aarch64_tdata (output_bfd)->n_bti_issues = 0;
+   elf_aarch64_tdata (output_bfd)->n_gcs_issues = 0;
--- a/binutils-sframe-PR32879.patch
+++ b/binutils-sframe-PR32879.patch
@ -0,0 +1,73 @@
+From 3602da6fa285d6b22d87bcc39056e919e939ef07 Mon Sep 17 00:00:00 2001
+From: Claudiu Zissulescu <claudiu.zissulescu-ianculescu@oracle.com>
+Date: Tue, 15 Apr 2025 12:20:40 +0300
+Subject: [PATCH] gas: sframe: fix handling of .cfi_def_cfa_register
+
+Fix PR gas/32879 sframe: Assembler internal error when translating
+cfi_def_cfa_register
+
+As per the documentation, .cfi_def_cfa_register modifies a rule for
+computing CFA; the register is updated, but the offset remains the same.
+
+While translating .cfi_def_cfa_register into SFrame context, we use the
+information from last translated FRE to set the CFA offset. However,
+there may be cases when the last translated FRE is empty.  Use last FRE
+only if available.
+
+Signed-off-by: Claudiu Zissulescu <claudiu.zissulescu-ianculescu@oracle.com>
+Signed-off-by: Indu Bhagat <indu.bhagat@oracle.com>
+---
+--- binutils-with-gold-2.44/gas/gen-sframe.c	2025-07-21 11:33:14.873962124 +0100
+++ binutils-with-gold-2.44.new/gas/gen-sframe.c	2025-07-21 11:32:44.715761914 +0100
+@@ -1041,7 +1041,9 @@ sframe_xlate_do_def_cfa_register (struct
+       return SFRAME_XLATE_ERR_NOTREPRESENTED; /* Not represented.  */
+     }
+   sframe_fre_set_cfa_base_reg (cur_fre, cfi_insn->u.ri.reg);
+-  sframe_fre_set_cfa_offset (cur_fre, last_fre->cfa_offset);
+  if (last_fre)
+    sframe_fre_set_cfa_offset (cur_fre, last_fre->cfa_offset);
+
+   cur_fre->merge_candidate = false;
+ 
+   return SFRAME_XLATE_OK;
+--- binutils-with-gold-2.44.orig/gas/testsuite/gas/cfi-sframe/cfi-sframe.exp	2025-07-21 09:33:40.785747847 +0100
+++ binutils-with-gold-2.44/gas/testsuite/gas/cfi-sframe/cfi-sframe.exp	2025-07-21 10:15:25.690664829 +0100
+@@ -89,6 +89,7 @@ if { [istarget "x86_64-*-*"] && [gas_sfr
+     if { [gas_x86_64_check] } then {
+ 	set ASFLAGS "$ASFLAGS --64"
+ 	run_dump_test "cfi-sframe-x86_64-1"
+	run_dump_test "cfi-sframe-x86_64-2"
+ 	set ASFLAGS "$old_ASFLAGS"
+     }
+ }
+--- /dev/null	2025-07-21 08:21:47.074898906 +0100
+++ binutils-with-gold-2.44/gas/testsuite/gas/cfi-sframe/cfi-sframe-x86_64-2.s	2025-07-21 10:08:25.354278907 +0100
+@@ -0,0 +1,4 @@
+# Although not a useful construct by itself, ensure graceful handling.
+	.cfi_startproc
+	.cfi_def_cfa_register 6
+	.cfi_endproc
+--- /dev/null	2025-07-21 08:21:47.074898906 +0100
+++ binutils-with-gold-2.44/gas/testsuite/gas/cfi-sframe/cfi-sframe-x86_64-2.d	2025-07-21 10:08:25.354223801 +0100
+@@ -0,0 +1,21 @@
+#as: --gsframe
+#objdump: --sframe=.sframe
+#name: Check .cfi_def_cfa_register with no previous offset
+#...
+Contents of the SFrame section .sframe:
+
+  Header :
+
+    Version: SFRAME_VERSION_2
+    Flags: NONE
+#?    CFA fixed FP offset: \-?\d+
+#?    CFA fixed RA offset: \-?\d+
+    Num FDEs: 1
+    Num FREs: 1
+
+  Function Index :
+
+    func idx \[0\]: pc = 0x0, size = 0 bytes
+    STARTPC +CFA +FP +RA +
+    0+0000 +fp\+8 +u +f +
+#pass
--- a/binutils-testsuite-fixes.patch
+++ b/binutils-testsuite-fixes.patch
@ -1067,3 +1067,13 @@ diff -rup bin.orig/ld/testsuite/ld-x86-64/sframe-pltgot-2.d binutils-2.43.50-55e
 # Skip if OFILES aren't provided, it can happen when lauching
 # the testsuites outside the build directory.
 if {![info exists OFILES]} {
+--- binutils.orig/ld/testsuite/ld-vsb/vsb.exp	2025-02-07 11:24:06.084525843 +0000
+++ binutils-with-gold-2.44/ld/testsuite/ld-vsb/vsb.exp	2025-02-07 11:26:34.984041584 +0000
+@@ -366,7 +366,6 @@ proc visibility_run {visibility} {
+ 		 || [ string match $visibility "protected_weak" ]
+ 		 || [ string match $visibility "normal" ] } {
+ 		setup_xfail "powerpc-*-linux*"
+-		setup_xfail "s390x-*-linux*"
+ 		if { [istarget sparc*-*-linux*] && [is_elf64 $tmpdir/mainnp.o] } {
+ 		    setup_xfail "sparc*-*-linux*"
+ 		}
--- a/binutils.spec
+++ b/binutils.spec
@ -7,7 +7,7 @@ Name: binutils%{?_with_debug:-debug}
 # The variable %%{source} (see below) should be set to indicate which of these
 # origins is being used.
 Version: 2.44
-Release: 1%{?dist}
+Release: 12%{?dist}
 License: GPL-3.0-or-later AND (GPL-3.0-or-later WITH Bison-exception-2.2) AND (LGPL-2.0-or-later WITH GCC-exception-2.0) AND BSD-3-Clause AND GFDL-1.3-or-later AND GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.0-or-later
 URL: https://sourceware.org/binutils

@ -258,67 +258,119 @@ Patch06: binutils-2.27-aarch64-ifunc.patch
 # Lifetime: Permanent.
 Patch07: binutils-do-not-link-with-static-libstdc++.patch

-# Purpose:  Allow OS specific sections in section groups.
-# Lifetime: Fixed in 2.43 (maybe)
-# Patch08: binutils-special-sections-in-groups.patch
-
 # Purpose:  Stop gold from aborting when input sections with the same name
 #            have different flags.
 # Lifetime: Fixed in 2.43 (maybe)
-Patch09: binutils-gold-mismatched-section-flags.patch
+Patch08: binutils-gold-mismatched-section-flags.patch

 # Purpose:  Change the gold configuration script to only warn about
 #            unsupported targets.  This allows the binutils to be built with
 #            BPF support enabled.
 # Lifetime: Permanent.
-Patch10: binutils-gold-warn-unsupported.patch
+Patch09: binutils-gold-warn-unsupported.patch

 # Purpose:  Enable the creation of .note.gnu.property sections by the GOLD
 #            linker for x86 binaries.
 # Lifetime: Permanent.
-Patch11: binutils-gold-i386-gnu-property-notes.patch
+Patch10: binutils-gold-i386-gnu-property-notes.patch

 # Purpose:  Allow the binutils to be configured with any (recent) version of
 #            autoconf.
 # Lifetime: Fixed in 2.44 (maybe ?)
-Patch12: binutils-autoconf-version.patch
+Patch11: binutils-autoconf-version.patch

 # Purpose:  Stop libtool from inserting useless runpaths into binaries.
 # Lifetime: Who knows.
-Patch13: binutils-libtool-no-rpath.patch
+Patch12: binutils-libtool-no-rpath.patch

 # Purpose:  Stop an abort when using dwp to process a file with no dwo links.
 # Lifetime: Fixed in 2.44 (maybe)
-Patch15: binutils-gold-empty-dwp.patch
+Patch13: binutils-gold-empty-dwp.patch

 # Purpose:  Fix binutils testsuite failures.
 # Lifetime: Permanent, but varies with each rebase.
-Patch16: binutils-testsuite-fixes.patch
+Patch14: binutils-testsuite-fixes.patch

 # Purpose:  Fix binutils testsuite failures for the RISCV-64 target.
 # Lifetime: Permanent, but varies with each rebase.
-Patch17: binutils-riscv-testsuite-fixes.patch
+Patch15: binutils-riscv-testsuite-fixes.patch

 # Purpose:  Make the GOLD linker ignore the "-z pack-relative-relocs" command line option.
 # Lifetime: Fixed in 2.44 (maybe)
-Patch18: binutils-gold-pack-relative-relocs.patch
+Patch16: binutils-gold-pack-relative-relocs.patch

 # Purpose:  Let the gold linker ignore --error-execstack and --error-rwx-segments.
 # Lifetime: Fixed in 2.44 (maybe)
-Patch19: binutils-gold-ignore-execstack-error.patch
+Patch17: binutils-gold-ignore-execstack-error.patch

 # Purpose:  Fix the ar test of non-deterministic archives.
 # Lifetime: Fixed in 2.44
-Patch20: binutils-fix-ar-test.patch
+Patch18: binutils-fix-ar-test.patch

-# # Purpose:  Reverts commit 4f576180 which moves the .note.build-id section to the start of the file.
-# # Lifetime: TTEMPORARY
-# Patch98: binutils-revert-note-id-move.patch
+# Purpose:  Fix a seg fault in the AArch64 linker when building u-boot.
+# Lifetime: Fixed in 2.45
+Patch19: binutils-aarch64-small-plt0.patch
+
+# Purpose:  Stops excessive memory use when copying corrupt files.
+# Lifetime: Fixed in 2.45
+Patch20: binutils-CVE-2025-7545.patch
+
+# Purpose:  Stops illegal memory access when parsing corrupt files.
+# Lifetime: Fixed in 2.45
+Patch21: binutils-CVE-2025-7546.patch
+
+# Purpose:  Stops a potential null pointer dereference when generating sframe
+#            information in the assembler.
+# Lifetime: Fixed in 2.45
+Patch22: binutils-sframe-PR32879.patch
+
+# Purpose:  Stops a potential null pointer dereference when examining corrupt
+#            DWARF debug information.
+# Lifetime: Fixed in 2.45
+Patch23: binutils-CVE-2025-8224.patch
+
+# Purpose:  Stops a potential illegal memory access when linking a corrupt
+#            input file.  PR 33457
+# Lifetime: Fixed in 2.46
+Patch24: binutils-CVE-2025-11083.patch
+
+# Purpose:  Stops a potential illegal memory access when linking a corrupt
+#            input file.  PR 33464
+# Lifetime: Fixed in 2.46
+Patch25: binutils-CVE-2025-11082.patch
+
+# Purpose:  Stops a potential illegal memory access when linking a corrupt
+#            input file.  PR 33451
+# Lifetime: Fixed in 2.46
+Patch26: binutils-CVE-2025-11495.patch
+
+# Purpose:  Stops a potential illegal memory access when linking a corrupt
+#            input file.  PR 33499
+# Lifetime: Fixed in 2.46
+Patch27: binutils-CVE-2025-11494.patch
+
+# Purpose:  Stops a potential illegal memory access when linking a corrupt
+#            input file.  PR 33455
+# Lifetime: Fixed in 2.46
+Patch28: binutils-CVE-2025-11840.patch
+
+# Purpose:  Stops a potential call to abort when displaying the debug info
+#            of a corrupt input file.  PR 33448
+# Lifetime: Fixed in 2.46
+Patch29: binutils-CVE-2025-11839.patch
+
+#----------------------------------------------------------------------------

 # Purpose:  Suppress the x86 linker's p_align-1 tests due to kernel bug on CentOS-10
 # Lifetime: TEMPORARY
 Patch99: binutils-suppress-ld-align-tests.patch

+# Purpose: Disable GCS warnings when shared dependencies are not built with GCS
+# support
+# Lifetime: TEMPORARY
+Patch100: binutils-disable-gcs-report-dynamic.patch
+Patch101: binutils-disable-gcs-report-dynamic-tests.patch
+
 #----------------------------------------------------------------------------

 Provides: bundled(libiberty)
@ -760,10 +812,13 @@ run_target_configuration()

    %set_build_flags

-%ifarch %{power64}
-    export CFLAGS="$RPM_OPT_FLAGS -Wno-error"
-%else
    export CFLAGS="$RPM_OPT_FLAGS"
+
+    # Some GNU extensions to the C11 standard are used.
+    export CFLAGS="$CFLAGS -std=gnu11"
+
+%ifarch %{power64}
+    export CFLAGS="$CFLAGS -Wno-error"
 %endif

 %if %{with debug}
@ -1419,6 +1474,40 @@ exit 0

 #----------------------------------------------------------------------------
 %changelog
+* Mon Oct 13 2025 Nick Clifton <nickc@redhat.com> - 2.44-12
+- Stop a potential call to abort when display the debug information of a corrupt input file.  (#2404504)
+
+* Mon Oct 13 2025 Nick Clifton <nickc@redhat.com> - 2.44-11
+- Stop a potential illegal memory access when linking a corrupt input file.  (#2404553)
+
+* Mon Oct 13 2025 Nick Clifton <nickc@redhat.com> - 2.44-10
+- Stop a potential illegal memory access when linking a corrupt input file.  (#2402842)
+
+* Fri Oct 10 2025 Nick Clifton <nickc@redhat.com> - 2.44-9
+- Stop a potential illegal memory access when linking a corrupt input file.  (#2402839)
+
+* Fri Oct 03 2025 Nick Clifton <nickc@redhat.com> - 2.44-8
+- Stop a potential illegal memory access when linking a corrupt input file.  (#2400342)
+
+* Thu Oct 02 2025 Nick Clifton <nickc@redhat.com> - 2.44-7
+- Stop a potential illegal memory access when linking a corrupt input file.  (#2400338)
+
+* Tue Jul 29 2025 Nick Clifton <nickc@redhat.com> - 2.44-6
+- Stop a potential null pointer dereference when examining corrupt DWARF debug information.  (#2383860)  (#2383873)
+
+* Mon Jul 21 2025 Nick Clifton <nickc@redhat.com> - 2.44-5
+- Stop a potential null pointer dereference when generating sframe information.  (#1282126)
+
+* Mon Jul 14 2025 Nick Clifton <nickc@redhat.com> - 2.44-4
+- Stop excessive memory allocation when copying corrupt files.  (#2379837)
+- Stop illegal memory access when parsing corrupt files.  (#2379844)
+
+* Fri Feb 07 2025 Nick Clifton <nickc@redhat.com> - 2.44-3
+- Fix seg fault in AArch64 linker when building u-boot.  (#2326190)
+
+* Thu Feb 06 2025 Siddhesh Poyarekar <siddhesh@redhat.com> - 2.44-2
+- Default gcs-report-dynamic to NONE for Fedora.
+
 * Mon Feb 03 2025 Nick Clifton <nickc@redhat.com> - 2.44-1
 - Rebase to official GNU Binutils 2.44 release
Author	SHA1	Message	Date
Nick Clifton	b9a988f535	Stop a potential call to abort when display the debug information of a corrupt input file. (#2404504 )	2025-11-03 13:35:21 +00:00
Nick Clifton	31c06ef9b7	Stop a potential illegal memory access when linking a corrupt input file. (#2404553 )	2025-11-03 12:21:45 +00:00
Nick Clifton	4c86b7c1ff	Stop a potential illegal memory access when linking a corrupt input file. (#2402842 )	2025-10-13 11:43:09 +01:00
Nick Clifton	e76eaf1165	Stop a potential illegal memory access when linking a corrupt input file. (#2402839 )	2025-10-10 13:10:32 +01:00
Nick Clifton	b04ce7a1de	Stop a potential illegal memory access when linking a corrupt input file. (#2400342 )	2025-10-03 13:25:34 +01:00
Nick Clifton	606bfc8184	Stop a potential illegal memory access when linking a corrupt input file. (#2400304 )	2025-10-02 16:04:12 +01:00
Nick Clifton	a5facb20e5	Stop a potential null pointer dereference when examining corrupt DWARF debug information. (#2383860 ) (#2383873 )	2025-07-29 15:09:36 +01:00
Nick Clifton	0cabb537f3	Stop a potential null pointer dereference when generating sframe information. (#1282126 )	2025-07-21 12:59:09 +01:00
Nick Clifton	33c91b6c27	Stop excessive memory allocation when copying corrupt files. (#2379837 ) Stop illegal memory access when parsing corrupt files. (#2379844)	2025-07-14 14:54:47 +01:00
Nick Clifton	09de9a498e	Renumber patches	2025-03-03 09:22:16 +00:00
Nick Clifton	fa76fd3465	Fix seg fault in AArch64 linker when building u-boot. (#2326190 )	2025-02-07 14:52:27 +00:00
Nick Clifton	4460e7482c	Default gcs-report-dynamic to NONE for Fedora.	2025-02-07 12:58:04 +00:00
Siddhesh Poyarekar	a3d25f1d56	Disable gcs-report-dynamic warnings The gcs-report-dynamic warnings have been failing builds in Fedora so default to disabled for now.	2025-02-06 12:11:03 -05:00