Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package binutils for openSUSE:Factory checked in at 2026-10-28 17:44:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/binutils (Old) and /work/SRC/openSUSE:Factory/.binutils.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "binutils" Wed Oct 28 17:44:00 2026 rev:187 rq:1392774 version:2.47 Changes: -------- --- /work/SRC/openSUSE:Factory/binutils/binutils.changes 2026-09-30 16:21:28.144378360 +0200 +++ /work/SRC/openSUSE:Factory/.binutils.new.2252680/binutils.changes 2026-10-28 17:44:03.123808548 +0100 @@ -1,0 +2,14 @@ +Mon Oct 26 16:05:48 UTC 2026 - Michael Matz <[email protected]> + +- Add a couple more CVE fixes that meanwhile got upstream: + * bsc#1280611 aka CVE-2026-91781 aka PR34449 + * bsc#1280605 aka CVE-2026-90828 aka PR34450 + * bsc#1275936 aka CVE-2026-19582 no PR + * bsc#1275267 aka CVE-2026-19548 no PR +- Also fixed already: + * bsc#1282138 aka CVE-2026-15003 aka PR34053 +- Add patches for the above: + binutils-fix-cve19582.diff, binutils-fix-cve19548.diff, + binutils-fix-pr34450.diff, binutils-fix-pr34449.diff + +------------------------------------------------------------------- @@ -15,0 +30,3 @@ + * stricter target checking: objcopy --target=X requires also the input + to be of target X; if one wants to specify output target, that is + --output-target=/-O X New: ---- binutils-fix-cve19548.diff binutils-fix-cve19582.diff binutils-fix-pr34449.diff binutils-fix-pr34450.diff ----------(New B)---------- New:- Add patches for the above: binutils-fix-cve19582.diff, binutils-fix-cve19548.diff, binutils-fix-pr34450.diff, binutils-fix-pr34449.diff New:- Add patches for the above: binutils-fix-cve19582.diff, binutils-fix-cve19548.diff, binutils-fix-pr34450.diff, binutils-fix-pr34449.diff New: binutils-fix-cve19582.diff, binutils-fix-cve19548.diff, binutils-fix-pr34450.diff, binutils-fix-pr34449.diff New: binutils-fix-cve19582.diff, binutils-fix-cve19548.diff, binutils-fix-pr34450.diff, binutils-fix-pr34449.diff ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ binutils.spec ++++++ --- /var/tmp/diff_new_pack.zJtAg5/_old 2026-10-28 17:44:05.099891139 +0100 +++ /var/tmp/diff_new_pack.zJtAg5/_new 2026-10-28 17:44:05.102891264 +0100 @@ -157,6 +157,10 @@ Patch43: binutils-revert-hlasm-insns.diff Patch44: binutils-revert-rela.diff Patch60: binutils-disable-code-arch-error.diff +Patch70: binutils-fix-cve19582.diff +Patch71: binutils-fix-cve19548.diff +Patch72: binutils-fix-pr34450.diff +Patch73: binutils-fix-pr34449.diff Patch90: cross-avr-nesc-as.patch Patch92: cross-avr-omit_section_dynsym.patch Patch93: cross-avr-size.patch @@ -323,6 +327,10 @@ %patch -P 44 -p1 %endif %patch -P 60 -p1 +%patch -P 70 -p1 +%patch -P 71 -p1 +%patch -P 72 -p1 +%patch -P 73 -p1 %if "%{TARGET}" == "avr" cp gas/config/tc-avr.h gas/config/tc-avr-nesc.h %patch -P 90 ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.zJtAg5/_old 2026-10-28 17:44:05.177894399 +0100 +++ /var/tmp/diff_new_pack.zJtAg5/_new 2026-10-28 17:44:05.180894525 +0100 @@ -1,5 +1,5 @@ -mtime: 1790084993 -commit: c46ecfe59d1bdaa32022b388750eeabc7f982a0820e563e346920e3199b7e2a8 +mtime: 1793031629 +commit: 9b848f834ce835152d1f7480a1b78cea8bdec87c0ad61b45677d16c7e77e81e8 url: https://src.opensuse.org/gcc/binutils.git revision: main ++++++ binutils-fix-cve19548.diff ++++++ commit d9ab6e42e739fe826b02a5f868586132ea2d893a Author: Alan Modra <[email protected]> Date: Sat Aug 15 00:17:56 2026 +0100 PR ld/24600: BFD: Fix use-after-free from `_bfd_load_armap' Fix an issue in commit e34fd4bfa6d7 ("PR ld/24600: BFD: Add general linker support for mapless archives") where the symbol map created by `_bfd_load_armap' has its entries discarded by a call to `bfd_release' after return to `_bfd_compute_and_push_armap' where all objalloc memory is freed that came starting from the dummy `first_name' allocation. This has been found in the context of CVE-2026-19548, <https://nvd.nist.gov/vuln/detail/CVE-2026-19548>. Also remove the "name" indirection in struct orl as that pointer is never modified so we are just wasting memory, and remove "namidx" too as that can easily be recalculated when writing an armap. Co-Authored-By: Maciej W. Rozycki <[email protected]> PR ld/24600 * archive.c (struct orl): Remove "name" indirection. Delete "namidx". (_bfd_load_armap): Don't copy name. (_bfd_compute_and_push_armap): Adjust for struct orl changes. Use memcpy rather than strcpy when copying symbol name. Don't release bfd_alloc'd memory when keep_symdefs. (_bfd_bsd_write_armap): Calculate namidx from names. Adjust for struct orl "name" change. (_bfd_coff_write_armap): Adjust for struct orl "name" change. * archive64.c (_bfd_archive_64_bit_write_armap): Likewise. * coff-rs6000.c (xcoff_write_armap_old): Likewise. (xcoff_write_armap_big): Likewise. * ecoff.c (_bfd_ecoff_write_armap): Calculate namidx from names. Adjust for struct orl "name" change. * libbfd.h: Regenerate. diff --git a/bfd/archive.c b/bfd/archive.c index 1bff31b6d09..6b3cef692c4 100644 --- a/bfd/archive.c +++ b/bfd/archive.c @@ -175,9 +175,8 @@ INTERNAL .{* Used in generating armaps (archive tables of contents). *} .struct orl {* Output ranlib. *} .{ -. char **name; {* Symbol name. *} +. char *name; {* Symbol name. *} . bfd *abfd; {* Containing BFD. *} -. int namidx; {* Index into string table. *} .}; . .{* Return an inexistent element reference for archive ARCH. *} @@ -1023,29 +1022,13 @@ _bfd_load_armap (bfd *arch, unsigned int elength ATTRIBUTE_UNUSED, counter < ardata->symdef_count; counter++, set++) { - bfd_size_type namelen = strlen (*map[counter].name) + 1; - char *name = bfd_alloc (arch, namelen); - - if (name == NULL) - { - bfd_set_error (bfd_error_no_memory); - goto release_symdefs; - } - - memcpy (name, *map[counter].name, namelen); - set->name = name; + set->name = map[counter].name; set->u.abfd = map[counter].abfd; } ardata->symdef_use_bfd = true; arch->has_armap = true; return true; - - release_symdefs: - bfd_release (arch, ardata->symdefs); - ardata->symdef_count = 0; - ardata->symdefs = NULL; - return false; } /* Iterate over members of archive ARCH starting from FIRST_ONE and @@ -2453,8 +2436,7 @@ _bfd_write_armap (bfd *arch, unsigned int elength, /* Iterate over members of archive ARCH retrieving their symbols and then push the symbols out using PUSH_ARMAP handler, giving it extended name - table length ELENGTH. Retain the information according to KEEP_SYMTAB. - Note that the namidx for the first symbol is 0. */ + table length ELENGTH. Retain the information according to KEEP_SYMTAB. */ bool _bfd_compute_and_push_armap @@ -2577,20 +2559,15 @@ _bfd_compute_and_push_armap (_("%pB: plugin needed to handle lto object"), current); } - namelen = strlen (syms[src_count]->name); - amt = sizeof (char *); - map[orl_count].name = (char **) bfd_alloc (arch, amt); + namelen = strlen (syms[src_count]->name) + 1; + map[orl_count].name = bfd_alloc (arch, namelen); if (map[orl_count].name == NULL) goto error_return; - *(map[orl_count].name) = (char *) bfd_alloc (arch, - namelen + 1); - if (*(map[orl_count].name) == NULL) - goto error_return; - strcpy (*(map[orl_count].name), syms[src_count]->name); + memcpy (map[orl_count].name, syms[src_count]->name, + namelen); map[orl_count].abfd = current; - map[orl_count].namidx = stridx; - stridx += namelen + 1; + stridx += namelen; ++orl_count; } } @@ -2605,10 +2582,12 @@ _bfd_compute_and_push_armap /* OK, now we have collected all the data, let's push them out. */ ret = push_armap (arch, elength, map, orl_count, stridx); + if (!ret) + goto error_return; free (syms); free (map); - if (first_name != NULL) + if (!keep_symtab) bfd_release (arch, first_name); return ret; @@ -2641,6 +2620,7 @@ _bfd_bsd_write_armap (bfd *arch, unsigned int count; struct ar_hdr hdr; long uid, gid; + unsigned int namidx = 0; first = mapsize + elength + sizeof (struct ar_hdr) + SARMAG; @@ -2753,11 +2733,13 @@ _bfd_bsd_write_armap (bfd *arch, } last_elt = current; - H_PUT_32 (arch, map[count].namidx, buf); + H_PUT_32 (arch, namidx, buf); H_PUT_32 (arch, firstreal, buf + BSD_SYMDEF_OFFSET_SIZE); if (bfd_write (buf, BSD_SYMDEF_SIZE, arch) != BSD_SYMDEF_SIZE) return false; + + namidx += strlen (map[count].name) + 1; } /* Now write the strings themselves. */ @@ -2766,9 +2748,9 @@ _bfd_bsd_write_armap (bfd *arch, return false; for (count = 0; count < orl_count; count++) { - size_t len = strlen (*map[count].name) + 1; + size_t len = strlen (map[count].name) + 1; - if (bfd_write (*map[count].name, len, arch) != len) + if (bfd_write (map[count].name, len, arch) != len) return false; } @@ -2982,9 +2964,9 @@ _bfd_coff_write_armap (bfd *arch, /* Now write the strings themselves. */ for (count = 0; count < symbol_count; count++) { - size_t len = strlen (*map[count].name) + 1; + size_t len = strlen (map[count].name) + 1; - if (bfd_write (*map[count].name, len, arch) != len) + if (bfd_write (map[count].name, len, arch) != len) return false; } diff --git a/bfd/archive64.c b/bfd/archive64.c index 1201a2f73a7..508810ba5e3 100644 --- a/bfd/archive64.c +++ b/bfd/archive64.c @@ -247,9 +247,9 @@ _bfd_archive_64_bit_write_armap (bfd *arch, /* now write the strings themselves */ for (count = 0; count < symbol_count; count++) { - size_t len = strlen (*map[count].name) + 1; + size_t len = strlen (map[count].name) + 1; - if (bfd_write (*map[count].name, len, arch) != len) + if (bfd_write (map[count].name, len, arch) != len) return false; } diff --git a/bfd/coff-rs6000.c b/bfd/coff-rs6000.c index f945b235cfa..c1adcd5ed49 100644 --- a/bfd/coff-rs6000.c +++ b/bfd/coff-rs6000.c @@ -1944,7 +1944,7 @@ xcoff_write_armap_old (bfd *abfd, unsigned int elength ATTRIBUTE_UNUSED, const char *name; size_t namlen; - name = *map[i].name; + name = map[i].name; namlen = strlen (name); if (bfd_write (name, namlen + 1, abfd) != namlen + 1) return false; @@ -2058,7 +2058,7 @@ xcoff_write_armap_big (bfd *abfd, unsigned int elength ATTRIBUTE_UNUSED, arch_info = bfd_get_arch_info (current_bfd); while (map[i].abfd == current_bfd) { - string_length = strlen (*map[i].name) + 1; + string_length = strlen (map[i].name) + 1; if (arch_info->bits_per_address == 64) { sym_64++; @@ -2175,7 +2175,7 @@ xcoff_write_armap_big (bfd *abfd, unsigned int elength ATTRIBUTE_UNUSED, { if (arch_info->bits_per_address == 32) { - string_length = sprintf (st, "%s", *map[i].name); + string_length = sprintf (st, "%s", map[i].name); st += string_length + 1; } i++; @@ -2259,7 +2259,7 @@ xcoff_write_armap_big (bfd *abfd, unsigned int elength ATTRIBUTE_UNUSED, { if (arch_info->bits_per_address == 64) { - string_length = sprintf (st, "%s", *map[i].name); + string_length = sprintf (st, "%s", map[i].name); st += string_length + 1; } i++; diff --git a/bfd/ecoff.c b/bfd/ecoff.c index 906fe44725e..b8665b09e1f 100644 --- a/bfd/ecoff.c +++ b/bfd/ecoff.c @@ -3115,6 +3115,7 @@ _bfd_ecoff_write_armap (bfd *abfd, bfd_byte *hashtable; bfd *current; bfd *last_elt; + unsigned int namidx = 0; /* Ultrix appears to use as a hash table size the least power of two greater than twice the number of entries. */ @@ -3205,7 +3206,7 @@ _bfd_ecoff_write_armap (bfd *abfd, last_elt = current; - hash = ecoff_armap_hash (*map[i].name, &rehash, hashsize, hashlog); + hash = ecoff_armap_hash (map[i].name, &rehash, hashsize, hashlog); if (H_GET_32 (abfd, (hashtable + (hash * 8) + 4)) != 0) { unsigned int srch; @@ -3222,8 +3223,10 @@ _bfd_ecoff_write_armap (bfd *abfd, hash = srch; } - H_PUT_32 (abfd, map[i].namidx, (hashtable + hash * 8)); - H_PUT_32 (abfd, firstreal, (hashtable + hash * 8 + 4)); + H_PUT_32 (abfd, namidx, hashtable + hash * 8); + H_PUT_32 (abfd, firstreal, hashtable + hash * 8 + 4); + + namidx += strlen (map[i].name) + 1; } if (bfd_write (hashtable, symdefsize, abfd) != symdefsize) @@ -3239,8 +3242,8 @@ _bfd_ecoff_write_armap (bfd *abfd, { bfd_size_type len; - len = strlen (*map[i].name) + 1; - if (bfd_write (*map[i].name, len, abfd) != len) + len = strlen (map[i].name) + 1; + if (bfd_write (map[i].name, len, abfd) != len) return false; } diff --git a/bfd/libbfd.h b/bfd/libbfd.h index 6e737e468df..ed5d7cf382a 100644 --- a/bfd/libbfd.h +++ b/bfd/libbfd.h @@ -1008,9 +1008,8 @@ extern const struct bfd_iovec _bfd_memory_iovec; /* Used in generating armaps (archive tables of contents). */ struct orl /* Output ranlib. */ { - char **name; /* Symbol name. */ + char *name; /* Symbol name. */ bfd *abfd; /* Containing BFD. */ - int namidx; /* Index into string table. */ }; /* Return an inexistent element reference for archive ARCH. */ ++++++ binutils-fix-cve19582.diff ++++++ commit 192afd3ce7c2324cdbee2d4646df6cf1e9b6fd09 Author: Nick Clifton <[email protected]> Date: Wed Sep 2 09:55:01 2026 +0100 Fix CVE-2026-19582 - a potential buffer overflow in rsrc_resource_name. diff --git a/bfd/peXXigen.c b/bfd/peXXigen.c index 9794ecdaabe..17a94c461fe 100644 --- a/bfd/peXXigen.c +++ b/bfd/peXXigen.c @@ -3811,92 +3811,152 @@ rsrc_cmp (bool is_name, rsrc_entry * a, rsrc_entry * b) return res; } -static void -rsrc_print_name (char * buffer, rsrc_string string) +static bool +rsrc_string_print_str (rsrc_string buffer, const char * format, char * context) +{ + if (buffer.string == NULL || buffer.len == 0) + return false; + + int printed = snprintf ((char *) buffer.string, buffer.len, format, context); + + if (printed >= (int) buffer.len) + { + buffer.len = 0; + return false; + } + + buffer.string += printed; + buffer.len -= printed; + return true; +} + +static bool +rsrc_string_print_int (rsrc_string buffer, const char * format, int context) +{ + if (buffer.string == NULL || buffer.len == 0) + return false; + + int printed = snprintf ((char *) buffer.string, buffer.len, format, context); + + if (printed >= (int) buffer.len) + { + buffer.len = 0; + return false; + } + + buffer.string += printed; + buffer.len -= printed; + return true; +} + +static bool +rsrc_print_name (rsrc_string buffer, rsrc_string string) { unsigned int i; bfd_byte * name = string.string; for (i = string.len; i--; name += 2) - sprintf (buffer + strlen (buffer), "%.1s", name); + { + if (! rsrc_string_print_str (buffer, "%.1s", (char *) name)) + return false; + } + + return true; } -static const char * -rsrc_resource_name (rsrc_entry *entry, rsrc_directory *dir, char *buffer) +static bool +rsrc_resource_name (rsrc_entry *entry, rsrc_directory *dir, rsrc_string buffer) { bool is_string = false; + bool res = true; - buffer[0] = 0; + if (buffer.string == NULL || buffer.len == 0) + return false; + + buffer.string[0] = 0; - if (dir != NULL && dir->entry != NULL && dir->entry->parent != NULL + if (dir != NULL + && dir->entry != NULL + && dir->entry->parent != NULL && dir->entry->parent->entry != NULL) { - strcpy (buffer, "type: "); + res &= rsrc_string_print_str (buffer, "%s", "type: "); + if (dir->entry->parent->entry->is_name) - rsrc_print_name (buffer + strlen (buffer), - dir->entry->parent->entry->name_id.name); + { + res &= rsrc_print_name (buffer, dir->entry->parent->entry->name_id.name); + } else { unsigned int id = dir->entry->parent->entry->name_id.id; - sprintf (buffer + strlen (buffer), "%x", id); + res &= rsrc_string_print_int (buffer, "%x", id); + switch (id) { - case 1: strcat (buffer, " (CURSOR)"); break; - case 2: strcat (buffer, " (BITMAP)"); break; - case 3: strcat (buffer, " (ICON)"); break; - case 4: strcat (buffer, " (MENU)"); break; - case 5: strcat (buffer, " (DIALOG)"); break; - case 6: strcat (buffer, " (STRING)"); is_string = true; break; - case 7: strcat (buffer, " (FONTDIR)"); break; - case 8: strcat (buffer, " (FONT)"); break; - case 9: strcat (buffer, " (ACCELERATOR)"); break; - case 10: strcat (buffer, " (RCDATA)"); break; - case 11: strcat (buffer, " (MESSAGETABLE)"); break; - case 12: strcat (buffer, " (GROUP_CURSOR)"); break; - case 14: strcat (buffer, " (GROUP_ICON)"); break; - case 16: strcat (buffer, " (VERSION)"); break; - case 17: strcat (buffer, " (DLGINCLUDE)"); break; - case 19: strcat (buffer, " (PLUGPLAY)"); break; - case 20: strcat (buffer, " (VXD)"); break; - case 21: strcat (buffer, " (ANICURSOR)"); break; - case 22: strcat (buffer, " (ANIICON)"); break; - case 23: strcat (buffer, " (HTML)"); break; - case 24: strcat (buffer, " (MANIFEST)"); break; - case 240: strcat (buffer, " (DLGINIT)"); break; - case 241: strcat (buffer, " (TOOLBAR)"); break; + case 1: res &= rsrc_string_print_str (buffer, "%s", " (CURSOR)"); break; + case 2: res &= rsrc_string_print_str (buffer, "%s", " (BITMAP)"); break; + case 3: res &= rsrc_string_print_str (buffer, "%s", " (ICON)"); break; + case 4: res &= rsrc_string_print_str (buffer, "%s", " (MENU)"); break; + case 5: res &= rsrc_string_print_str (buffer, "%s", " (DIALOG)"); break; + case 6: res &= rsrc_string_print_str (buffer, "%s", " (STRING)"); is_string = true; break; + case 7: res &= rsrc_string_print_str (buffer, "%s", " (FONTDIR)"); break; + case 8: res &= rsrc_string_print_str (buffer, "%s", " (FONT)"); break; + case 9: res &= rsrc_string_print_str (buffer, "%s", " (ACCELERATOR)"); break; + case 10: res &= rsrc_string_print_str (buffer, "%s", " (RCDATA)"); break; + case 11: res &= rsrc_string_print_str (buffer, "%s", " (MESSAGETABLE)"); break; + case 12: res &= rsrc_string_print_str (buffer, "%s", " (GROUP_CURSOR)"); break; + case 14: res &= rsrc_string_print_str (buffer, "%s", " (GROUP_ICON)"); break; + case 16: res &= rsrc_string_print_str (buffer, "%s", " (VERSION)"); break; + case 17: res &= rsrc_string_print_str (buffer, "%s", " (DLGINCLUDE)"); break; + case 19: res &= rsrc_string_print_str (buffer, "%s", " (PLUGPLAY)"); break; + case 20: res &= rsrc_string_print_str (buffer, "%s", " (VXD)"); break; + case 21: res &= rsrc_string_print_str (buffer, "%s", " (ANICURSOR)"); break; + case 22: res &= rsrc_string_print_str (buffer, "%s", " (ANIICON)"); break; + case 23: res &= rsrc_string_print_str (buffer, "%s", " (HTML)"); break; + case 24: res &= rsrc_string_print_str (buffer, "%s", " (MANIFEST)"); break; + case 240: res &= rsrc_string_print_str (buffer, "%s", " (DLGINIT)"); break; + case 241: res &= rsrc_string_print_str (buffer, "%s", " (TOOLBAR)"); break; } } } if (dir != NULL && dir->entry != NULL) { - strcat (buffer, " name: "); + res &= rsrc_string_print_str (buffer, "%s", " name: "); + if (dir->entry->is_name) - rsrc_print_name (buffer + strlen (buffer), dir->entry->name_id.name); + { + res &= rsrc_print_name (buffer, dir->entry->name_id.name); + } else { unsigned int id = dir->entry->name_id.id; - sprintf (buffer + strlen (buffer), "%x", id); + res &= rsrc_string_print_int (buffer, "%x", id); if (is_string) - sprintf (buffer + strlen (buffer), " (resource id range: %d - %d)", - (id - 1) << 4, (id << 4) - 1); + { + res &= rsrc_string_print_str (buffer, "%s", " (resource id range: "); + res &= rsrc_string_print_int (buffer, "%d", (id - 1) << 4); + res &= rsrc_string_print_str (buffer, "%s", " - "); + res &= rsrc_string_print_int (buffer, "%d", (id << 4) - 1); + res &= rsrc_string_print_str (buffer, "%s", ")"); + } } } if (entry != NULL) { - strcat (buffer, " lang: "); + res &= rsrc_string_print_str (buffer, "%s", " lang: "); if (entry->is_name) - rsrc_print_name (buffer + strlen (buffer), entry->name_id.name); + res &= rsrc_print_name (buffer, entry->name_id.name); else - sprintf (buffer + strlen (buffer), "%x", entry->name_id.id); + res &= rsrc_string_print_int (buffer, "%x", entry->name_id.id); } - return buffer; + return res; } /* *sigh* Windows resource strings are special. Only the top 28-bits of @@ -4156,11 +4216,20 @@ rsrc_sort_entries (rsrc_dir_chain *chain, _bfd_error_handler (_(".rsrc merge failure: duplicate leaf")); else { - char buff[256]; - - _bfd_error_handler (_(".rsrc merge failure: duplicate leaf: %s"), - rsrc_resource_name (entry, dir, buff)); +#define RSRC_RES_NAME_LEN 256 + char buff[RSRC_RES_NAME_LEN]; + rsrc_string buffer; + + buffer.string = (bfd_byte *) buff; + buffer.len = RSRC_RES_NAME_LEN; + + if (rsrc_resource_name (entry, dir, buffer)) + _bfd_error_handler (_(".rsrc merge failure: duplicate leaf: %s"), + buffer.string); + else + _bfd_error_handler (_(".rsrc merge failure: duplicate leaf")); } + bfd_set_error (bfd_error_file_truncated); return; } ++++++ binutils-fix-pr34449.diff ++++++ commit 7322e9bc30cb282575a701c307851fd3d66fee68 Author: H.J. Lu <[email protected]> Date: Thu Jul 30 15:47:05 2026 +0800 x86-64: Return SHN_COMMON on non-ELF input elf_x86_64_common_definition segfaults on PE/x86-64 input. Return SHN_COMMON on non-ELF input. Linker now gets assertion fail at bfd/coffgen.c:575, instead of getting segfault. PR ld/34449 * elf64-x86-64.c (elf_x86_64_common_definition): Return SHN_COMMON on non-ELF input. Signed-off-by: H.J. Lu <[email protected]> diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c index ade6613b62a..3700520b40f 100644 --- a/bfd/elf64-x86-64.c +++ b/bfd/elf64-x86-64.c @@ -6091,7 +6091,8 @@ elf_x86_64_common_definition (Elf_Internal_Sym *sym) static unsigned int elf_x86_64_common_section_index (asection *sec) { - if ((elf_section_flags (sec) & SHF_X86_64_LARGE) == 0) + if (bfd_get_flavour (sec->owner) != bfd_target_elf_flavour + || (elf_section_flags (sec) & SHF_X86_64_LARGE) == 0) return SHN_COMMON; else return SHN_X86_64_LCOMMON; ++++++ binutils-fix-pr34450.diff ++++++ commit 123e4a5eab2db300b44288dcc1a29c903f9622f9 Author: Alan Modra <[email protected]> Date: Tue Sep 22 21:27:03 2026 +0930 PR 34450 SEGV in elf_orphan_compatible Don't trust that SHF_LINK_ORDER set means linked_to is non-NULL. * ldelf.c (elf_orphan_compatible): Sanity check linked_to before dereferencing. diff --git a/ld/ldelf.c b/ld/ldelf.c index c1f29608c6d..0fe69784e08 100644 --- a/ld/ldelf.c +++ b/ld/ldelf.c @@ -2129,6 +2129,7 @@ elf_orphan_compatible (asection *in, asection *out) || ((elf_section_flags (in) & SHF_LINK_ORDER) != 0 && (elf_section_flags (out) & SHF_LINK_ORDER) != 0 && elf_linked_to_section (in) != NULL + && elf_linked_to_section (out) != NULL && (elf_linked_to_section (in)->output_section != elf_linked_to_section (out)->output_section)) || ((elf_section_flags (out) ^ elf_section_flags (in)) ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-26 17:20:29.000000000 +0100 @@ -0,0 +1 @@ +.osc
