diff --git a/meta/recipes-devtools/binutils/binutils-2.46.inc b/meta/recipes-devtools/binutils/binutils-2.47.inc similarity index 74% rename from meta/recipes-devtools/binutils/binutils-2.46.inc rename to meta/recipes-devtools/binutils/binutils-2.47.inc index cab270cea5..3b2dfa4187 100644 --- a/meta/recipes-devtools/binutils/binutils-2.46.inc +++ b/meta/recipes-devtools/binutils/binutils-2.47.inc @@ -12,18 +12,13 @@ LIC_FILES_CHKSUM = "\ # When upgrading to next major release, ensure that there is no trailing .0, so # that upstream version check can work correctly. -PV = "2.46.1" -CVE_VERSION = "2.46.1" -SRCBRANCH ?= "binutils-2_46-branch" +PV = "2.47" +CVE_VERSION = "2.47" +SRCBRANCH ?= "binutils-2_47-branch" UPSTREAM_CHECK_GITTAGREGEX = "binutils-(?P\d+_(\d_?)*)" -CVE_STATUS[CVE-2025-69650] = "disputed: observed behavior only in pre-release code, does not affect any tagged version" -CVE_STATUS[CVE-2025-69651] = "disputed: observed behavior only in pre-release code, does not affect any tagged version" -CVE_STATUS[CVE-2025-69649] = "fixed-version: Fixed from version 2.46" -CVE_STATUS[CVE-2025-69652] = "fixed-version: Fixed from version 2.46" - -SRCREV ?= "5e56594815854de5eca35c7c04b11705d0f19c02" +SRCREV ?= "6ce87bbc521cf46eaee9a1f7ef61cee2cdfb3e32" BINUTILS_GIT_URI ?= "git://sourceware.org/git/binutils-gdb.git;branch=${SRCBRANCH};protocol=https" SRC_URI = "\ ${BINUTILS_GIT_URI} \ @@ -38,6 +33,4 @@ SRC_URI = "\ file://0012-Only-generate-an-RPATH-entry-if-LD_RUN_PATH-is-not-e.patch \ file://0013-Define-alignof-using-_Alignof-when-using-C11-or-newe.patch \ file://0014-Remove-duplicate-pe-dll.o-entry-deom-targ_extra_ofil.patch \ - file://CVE-2026-4647.patch \ - file://CVE-2026-6846.patch \ " diff --git a/meta/recipes-devtools/binutils/binutils-cross-canadian_2.46.bb b/meta/recipes-devtools/binutils/binutils-cross-canadian_2.47.bb similarity index 100% rename from meta/recipes-devtools/binutils/binutils-cross-canadian_2.46.bb rename to meta/recipes-devtools/binutils/binutils-cross-canadian_2.47.bb diff --git a/meta/recipes-devtools/binutils/binutils-cross_2.46.bb b/meta/recipes-devtools/binutils/binutils-cross_2.47.bb similarity index 100% rename from meta/recipes-devtools/binutils/binutils-cross_2.46.bb rename to meta/recipes-devtools/binutils/binutils-cross_2.47.bb diff --git a/meta/recipes-devtools/binutils/binutils-crosssdk_2.46.bb b/meta/recipes-devtools/binutils/binutils-crosssdk_2.47.bb similarity index 100% rename from meta/recipes-devtools/binutils/binutils-crosssdk_2.46.bb rename to meta/recipes-devtools/binutils/binutils-crosssdk_2.47.bb diff --git a/meta/recipes-devtools/binutils/binutils-testsuite_2.46.bb b/meta/recipes-devtools/binutils/binutils-testsuite_2.47.bb similarity index 100% rename from meta/recipes-devtools/binutils/binutils-testsuite_2.46.bb rename to meta/recipes-devtools/binutils/binutils-testsuite_2.47.bb diff --git a/meta/recipes-devtools/binutils/binutils/0008-Use-libtool-2.4.patch b/meta/recipes-devtools/binutils/binutils/0008-Use-libtool-2.4.patch index 33ec24ff6f..529aa629d7 100644 --- a/meta/recipes-devtools/binutils/binutils/0008-Use-libtool-2.4.patch +++ b/meta/recipes-devtools/binutils/binutils/0008-Use-libtool-2.4.patch @@ -5522,7 +5522,7 @@ index b97a2c6e6b6..3e171c6c536 100755 lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF --#line 11153 "configure" +-#line 11155 "configure" +line $LINENO "configure" #include "confdefs.h" @@ -5544,7 +5544,7 @@ index b97a2c6e6b6..3e171c6c536 100755 lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF --#line 11259 "configure" +-#line 11261 "configure" +#line $LINENO "configure" #include "confdefs.h" diff --git a/meta/recipes-devtools/binutils/binutils/0014-Remove-duplicate-pe-dll.o-entry-deom-targ_extra_ofil.patch b/meta/recipes-devtools/binutils/binutils/0014-Remove-duplicate-pe-dll.o-entry-deom-targ_extra_ofil.patch index 87ffc95ea2..29601e4373 100644 --- a/meta/recipes-devtools/binutils/binutils/0014-Remove-duplicate-pe-dll.o-entry-deom-targ_extra_ofil.patch +++ b/meta/recipes-devtools/binutils/binutils/0014-Remove-duplicate-pe-dll.o-entry-deom-targ_extra_ofil.patch @@ -18,10 +18,10 @@ Cc: Zac Walker 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ld/configure.tgt b/ld/configure.tgt -index 3e158913b89..be62b312a8e 100644 +index 60b62e69c08..60efa496910 100644 --- a/ld/configure.tgt +++ b/ld/configure.tgt -@@ -1008,7 +1008,7 @@ x86_64-*-cygwin) targ_emul=i386pep ; +@@ -992,7 +992,7 @@ x86_64-*-cygwin) targ_emul=i386pep ; ;; x86_64-*-mingw*) targ_emul=i386pep ; targ_extra_emuls=i386pe @@ -29,6 +29,6 @@ index 3e158913b89..be62b312a8e 100644 + targ_extra_ofiles="deffilep.o pdb.o pe-dll.o" ;; x86_64-*-gnu*) targ_emul=elf_x86_64 - targ_extra_emuls=elf_iamcu --- + targ_extra_libpath="elf_i386 elf32_x86_64" +-- 2.49.0 diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2026-4647.patch b/meta/recipes-devtools/binutils/binutils/CVE-2026-4647.patch deleted file mode 100644 index 5a51ea2d45..0000000000 --- a/meta/recipes-devtools/binutils/binutils/CVE-2026-4647.patch +++ /dev/null @@ -1,223 +0,0 @@ -From 9e99dbc1f19ffaf18d0250788951706066ebe7f2 Mon Sep 17 00:00:00 2001 -From: Alan Modra -Date: Fri, 13 Mar 2026 17:28:28 +1030 -Subject: [PATCH] PR33919 Out-of-bounds read in XCOFF relocation processing - - PR 33919 - * coff-rs6000.c (xcoff_calculate_relocation): Don't use explicit - array size. - (xcoff_complain_overflow): Likewise. - (xcoff_rtype2howto): Return a NULL howto rather than aborting. - (_bfd_xcoff_reloc_name_lookup): Use ARRAY_SIZE. - (xcoff_ppc_relocate_section): Sanity check reloc r_type before - accessing xcoff_howto_table. Print r_type using %#x. Remove - now redundant later reloc r_type sanity check. - * coff64-rs6000.c: Similarly. - * libxcoff.h (XCOFF_MAX_CALCULATE_RELOCATION): Don't define. - (XCOFF_MAX_COMPLAIN_OVERFLOW): Don't define. - -CVE: CVE-2026-4647 -Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=9e99dbc1f19ffaf18d0250788951706066ebe7f2] -Signed-off-by: Peter Marko ---- - bfd/coff-rs6000.c | 36 +++++++++++++++++++++--------------- - bfd/coff64-rs6000.c | 33 ++++++++++++++++++++------------- - bfd/libxcoff.h | 3 --- - 3 files changed, 41 insertions(+), 31 deletions(-) - -diff --git a/bfd/coff-rs6000.c b/bfd/coff-rs6000.c -index 62caae64f4e..00e0f5442f7 100644 ---- a/bfd/coff-rs6000.c -+++ b/bfd/coff-rs6000.c -@@ -155,8 +155,7 @@ static xcoff_complain_function xcoff_complain_overflow_bitfield_func; - static xcoff_complain_function xcoff_complain_overflow_signed_func; - static xcoff_complain_function xcoff_complain_overflow_unsigned_func; - --xcoff_reloc_function *const --xcoff_calculate_relocation[XCOFF_MAX_CALCULATE_RELOCATION] = -+xcoff_reloc_function *const xcoff_calculate_relocation[] = - { - xcoff_reloc_type_pos, /* R_POS (0x00) */ - xcoff_reloc_type_neg, /* R_NEG (0x01) */ -@@ -210,8 +209,7 @@ xcoff_calculate_relocation[XCOFF_MAX_CALCULATE_RELOCATION] = - xcoff_reloc_type_toc, /* R_TOCL (0x31) */ - }; - --xcoff_complain_function *const --xcoff_complain_overflow[XCOFF_MAX_COMPLAIN_OVERFLOW] = -+xcoff_complain_function *const xcoff_complain_overflow[] = - { - xcoff_complain_overflow_dont_func, - xcoff_complain_overflow_bitfield_func, -@@ -1158,8 +1156,11 @@ reloc_howto_type xcoff_howto_table[] = - void - xcoff_rtype2howto (arelent *relent, struct internal_reloc *internal) - { -- if (internal->r_type > R_TOCL) -- abort (); -+ if (internal->r_type >= ARRAY_SIZE (xcoff_howto_table)) -+ { -+ relent->howto = NULL; -+ return; -+ } - - /* Default howto layout works most of the time */ - relent->howto = &xcoff_howto_table[internal->r_type]; -@@ -1183,7 +1184,7 @@ xcoff_rtype2howto (arelent *relent, struct internal_reloc *internal) - if (relent->howto->dst_mask != 0 - && (relent->howto->bitsize - != ((unsigned int) internal->r_size & 0x1f) + 1)) -- abort (); -+ relent->howto = NULL; - } - - reloc_howto_type * -@@ -1236,9 +1237,7 @@ _bfd_xcoff_reloc_name_lookup (bfd *abfd ATTRIBUTE_UNUSED, - { - unsigned int i; - -- for (i = 0; -- i < sizeof (xcoff_howto_table) / sizeof (xcoff_howto_table[0]); -- i++) -+ for (i = 0; i < ARRAY_SIZE (xcoff_howto_table); i++) - if (xcoff_howto_table[i].name != NULL - && strcasecmp (xcoff_howto_table[i].name, r_name) == 0) - return &xcoff_howto_table[i]; -@@ -3763,6 +3762,14 @@ xcoff_ppc_relocate_section (bfd *output_bfd, - the csect including the symbol which it references. */ - if (rel->r_type == R_REF) - continue; -+ if (rel->r_type >= ARRAY_SIZE (xcoff_howto_table)) -+ { -+ /* xgettext:c-format */ -+ _bfd_error_handler (_("%pB: unsupported relocation type %#x"), -+ input_bfd, rel->r_type); -+ bfd_set_error (bfd_error_bad_value); -+ return false; -+ } - - /* Retrieve default value in HOWTO table and fix up according - to r_size field, if it can be different. -@@ -3782,7 +3789,7 @@ xcoff_ppc_relocate_section (bfd *output_bfd, - - default: - _bfd_error_handler -- (_("%pB: relocation (%d) at 0x%" PRIx64 " has wrong r_rsize (0x%x)\n"), -+ (_("%pB: relocation (%#x) at 0x%" PRIx64 " has wrong r_rsize (0x%x)\n"), - input_bfd, rel->r_type, (uint64_t) rel->r_vaddr, rel->r_size); - return false; - } -@@ -3858,10 +3865,9 @@ xcoff_ppc_relocate_section (bfd *output_bfd, - } - } - -- if (rel->r_type >= XCOFF_MAX_CALCULATE_RELOCATION -- || !((*xcoff_calculate_relocation[rel->r_type]) -- (input_bfd, input_section, output_bfd, rel, sym, &howto, val, -- addend, &relocation, contents, info))) -+ if (!((*xcoff_calculate_relocation[rel->r_type]) -+ (input_bfd, input_section, output_bfd, rel, sym, &howto, val, -+ addend, &relocation, contents, info))) - return false; - - /* address */ -diff --git a/bfd/coff64-rs6000.c b/bfd/coff64-rs6000.c -index fa1759b5925..f6a60433e62 100644 ---- a/bfd/coff64-rs6000.c -+++ b/bfd/coff64-rs6000.c -@@ -177,8 +177,7 @@ static bool xcoff64_bad_format_hook - /* Relocation functions */ - static xcoff_reloc_function xcoff64_reloc_type_br; - --xcoff_reloc_function *const --xcoff64_calculate_relocation[XCOFF_MAX_CALCULATE_RELOCATION] = -+xcoff_reloc_function *const xcoff64_calculate_relocation[] = - { - xcoff_reloc_type_pos, /* R_POS (0x00) */ - xcoff_reloc_type_neg, /* R_NEG (0x01) */ -@@ -1439,8 +1438,11 @@ reloc_howto_type xcoff64_howto_table[] = - void - xcoff64_rtype2howto (arelent *relent, struct internal_reloc *internal) - { -- if (internal->r_type > R_TOCL) -- abort (); -+ if (internal->r_type >= ARRAY_SIZE (xcoff64_howto_table)) -+ { -+ relent->howto = NULL; -+ return; -+ } - - /* Default howto layout works most of the time */ - relent->howto = &xcoff64_howto_table[internal->r_type]; -@@ -1473,7 +1475,7 @@ xcoff64_rtype2howto (arelent *relent, struct internal_reloc *internal) - if (relent->howto->dst_mask != 0 - && (relent->howto->bitsize - != ((unsigned int) internal->r_size & 0x3f) + 1)) -- abort (); -+ relent->howto = NULL; - } - - reloc_howto_type * -@@ -1528,9 +1530,7 @@ xcoff64_reloc_name_lookup (bfd *abfd ATTRIBUTE_UNUSED, - { - unsigned int i; - -- for (i = 0; -- i < sizeof (xcoff64_howto_table) / sizeof (xcoff64_howto_table[0]); -- i++) -+ for (i = 0; i < ARRAY_SIZE (xcoff64_howto_table); i++) - if (xcoff64_howto_table[i].name != NULL - && strcasecmp (xcoff64_howto_table[i].name, r_name) == 0) - return &xcoff64_howto_table[i]; -@@ -1574,6 +1574,14 @@ xcoff64_ppc_relocate_section (bfd *output_bfd, - the csect including the symbol which it references. */ - if (rel->r_type == R_REF) - continue; -+ if (rel->r_type >= ARRAY_SIZE (xcoff64_howto_table)) -+ { -+ /* xgettext:c-format */ -+ _bfd_error_handler (_("%pB: unsupported relocation type %#x"), -+ input_bfd, rel->r_type); -+ bfd_set_error (bfd_error_bad_value); -+ return false; -+ } - - /* Retrieve default value in HOWTO table and fix up according - to r_size field, if it can be different. -@@ -1595,7 +1603,7 @@ xcoff64_ppc_relocate_section (bfd *output_bfd, - - default: - _bfd_error_handler -- (_("%pB: relocation (%d) at (0x%" PRIx64 ") has wrong" -+ (_("%pB: relocation (%#x) at (0x%" PRIx64 ") has wrong" - " r_rsize (0x%x)\n"), - input_bfd, rel->r_type, rel->r_vaddr, rel->r_size); - return false; -@@ -1668,10 +1676,9 @@ xcoff64_ppc_relocate_section (bfd *output_bfd, - } - } - -- if (rel->r_type >= XCOFF_MAX_CALCULATE_RELOCATION -- || !((*xcoff64_calculate_relocation[rel->r_type]) -- (input_bfd, input_section, output_bfd, rel, sym, &howto, val, -- addend, &relocation, contents, info))) -+ if (!((*xcoff64_calculate_relocation[rel->r_type]) -+ (input_bfd, input_section, output_bfd, rel, sym, &howto, val, -+ addend, &relocation, contents, info))) - return false; - - /* address */ -diff --git a/bfd/libxcoff.h b/bfd/libxcoff.h -index c116d9b795f..e6b87975ff6 100644 ---- a/bfd/libxcoff.h -+++ b/bfd/libxcoff.h -@@ -217,9 +217,6 @@ struct xcoff_backend_data_rec - #define bfd_xcoff_text_align_power(a) ((xcoff_data (a)->text_align_power)) - #define bfd_xcoff_data_align_power(a) ((xcoff_data (a)->data_align_power)) - --/* xcoff*_ppc_relocate_section macros */ --#define XCOFF_MAX_CALCULATE_RELOCATION (0x32) --#define XCOFF_MAX_COMPLAIN_OVERFLOW (4) - /* N_ONES produces N one bits, without overflowing machine arithmetic. */ - #ifdef N_ONES - #undef N_ONES diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2026-6846.patch b/meta/recipes-devtools/binutils/binutils/CVE-2026-6846.patch deleted file mode 100644 index e7d1c3aa00..0000000000 --- a/meta/recipes-devtools/binutils/binutils/CVE-2026-6846.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 7a089e0302382f4d4e077941156e1eaa68d01393 Mon Sep 17 00:00:00 2001 -From: Alan Modra -Date: Mon, 6 Apr 2026 22:58:22 +0930 -Subject: [PATCH] PR 34049 buffer overflow in xcoff_link_add_symbols - -The fact that coffcode.h:coff_set_alignment_hook for rs6000 removes -sections can result in target_index > section_count. Thus any array -indexed by target_index must not be sized by section_count. - - PR ld/34049 - * xcofflink.c (xcoff_link_add_symbols): Size reloc_info array - using max target_index. - -CVE: CVE-2026-6846 -Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=7a089e0302382f4d4e077941156e1eaa68d01393] - -Signed-off-by: Alan Modra -(cherry picked from commit 7a089e0302382f4d4e077941156e1eaa68d01393) -Signed-off-by: Jaipaul Cheernam ---- - bfd/xcofflink.c | 15 ++++++++++++++- - 1 file changed, 14 insertions(+), 1 deletion(-) - -diff --git a/bfd/xcofflink.c b/bfd/xcofflink.c -index 1781182fa6a..7f1c0df760f 100644 ---- a/bfd/xcofflink.c -+++ b/bfd/xcofflink.c -@@ -1335,6 +1335,7 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info) - } *reloc_info = NULL; - bfd_size_type amt; - unsigned short visibility; -+ unsigned int max_target_index; - - keep_syms = obj_coff_keep_syms (abfd); - -@@ -1398,7 +1399,19 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info) - order by VMA within a given section, so we handle this by - scanning along the relocs as we process the csects. We index - into reloc_info using the section target_index. */ -- amt = abfd->section_count + 1; -+ max_target_index = 0; -+ for (o = abfd->section_last; o != NULL; o = o->prev) -+ if (o->target_index != 0) -+ { -+ /* The last section added from the object file will have the -+ highest target_index. See coffgen.c coff_real_object_p and -+ make_a_section_from_file. Sections added by -+ xcoff_link_create_extra_sections will have a zero -+ target_index. */ -+ max_target_index = o->target_index; -+ break; -+ } -+ amt = max_target_index + 1; - amt *= sizeof (struct reloc_info_struct); - reloc_info = bfd_zmalloc (amt); - if (reloc_info == NULL) --- -2.43.7 - diff --git a/meta/recipes-devtools/binutils/binutils_2.46.bb b/meta/recipes-devtools/binutils/binutils_2.47.bb similarity index 100% rename from meta/recipes-devtools/binutils/binutils_2.46.bb rename to meta/recipes-devtools/binutils/binutils_2.47.bb