A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object file during linking. A local attacker could trick a user into processing this malicious file, which could lead to arbitrary code execution, allowing the attacker to run unauthorized commands, or caus…
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption bey…
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to…
GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rnglists data. A logic flaw in the DWARF parsing path causes readelf to repeatedly print the same warning message without making forward progress, resulting in a non-terminating output loop that requires manual interruptio…
GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw in the DWARF parsing code can cause readelf to repeatedly print the same table output without making forward progress, resulting in an unbounded output loop that never terminates unless externally inte…
GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in process_debug_info(), an invalid debug_info_p state may propagate into DWARF attribute parsing routines. When certain malformed attributes result in…
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local atta…
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the handling of the debug_rnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The is…
GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dump_relocations returns early due to parsing errors, the internal all_relocations array may remain partially uninitialized. Later, process_got_section_contents() may attempt to free …
An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. A logic flaw in the handling of DWARF location list headers can cause objdump to enter an unbounded loop and produce endless output until manually interrupted. This issue affects versions …
A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to …
A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.45 is…
A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is n…
A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is…
A vulnerability was found in GNU Binutils 2.44 and classified as problematic. This issue affects the function process_debug_info of the file binutils/dwarf.c of the component DWARF Section Handler. The manipulation leads to memory leak. Attacking locally is a requirement. The identifier of the patch is e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4. It is recomme…
A vulnerability has been found in GNU Binutils 2.44 and classified as problematic. This vulnerability affects the function bfd_elf_get_str_section of the file bfd/elf.c of the component BFD Library. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be us…
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (2)
VuXML entries whose affected range this version has left.
all: drop support for FreeBSD 13, mips and risc64sf
Reviewed by: many (*)
Differential Revision: https://reviews.freebsd.org/D55624
Differential Revision: https://reviews.freebsd.org/D55642 (merged in from bofh)
many (*)
acm arrowd brooks cmt dch decke dinoex eduardo fluffy fuz gahr garga
jbeich joerg jrm kai kenrap martymac matthew mfechner michaelo mizhka
nobutaka pkubaj se tagattie thj
Anton Saietskii
GenericRikka
Gert Doering
Jan Bramkamp
Oleh Hushchenkov
Oleksandr Kryvulia
Ralf van der Enden
Yamagi
desktop kde python tcltk office
devel/binutils: update to 2.43
Original patch (files/patch-* and native pkg-plist) by
alster@vinterdalen.se. I separated cosmetic and other changes not
related to the update into three prior commits and fixed
pkg-plist packaging failures.
The process used to fix pkg-plist problems resulted in correct sorting
of ldscripts pkg-plist information. This part of the change should have
been proactively fixed but the issue wasn't discovered until merging
orphaned files back into the various pkg-plist files. Rather than
introduce possible new breakage while trying to preemptively sort
pkg-plist in a prior commit, let's just accept this change with the
upgrade.
PR: 281070
Security: CVE-2023-1972, CVE-2023-25585, CVE-2023-25586,
CVE-2023-25588
Exp-run by: antoine
devel/binutils: Remove autodependency on devel/elfutils
Users who manually pre-install devel/elfutils and subsequently
manually build and install binutils must now enable the dependency.
The previous commit provided the option but also didn't change the
implied (autodetect) behavior. This change now disables elfutils
autodetection. Users must now explicitly enable the option if they
were previously relying on autodetection.
Requested by: mat, jrm
devel/binutils: Add devel/elfutils dependency options
Currently binutils auto-discovers libdebuginfod.so existence in
$LOCALBASE and if found, it will use it. This doesn't matter when
building under poudriere because devel/elfutils is never
pre-installed as a dependency.
However users building binutils on systems with a pre-installed
devel/elfutils will discover that binutils will auto-detect the
existence of libdebuginfod.so and use it. This is not always desired.
Therefore add an option so that users who build binuitls by hand
can optionally force binutils not to detect or use libdebuginfod.so.
On the flip side other users may want to depend on devel/elfutils and
have the ports infrastructure preinstall it for them.
The default option is to auto-detect and depend on devel/elfutils if
found.
PR: 273798
devel/binutils: fix build with libc++ 19
As noted in the libc++ 19 release notes [1], std::char_traits<> is now
only provided for char, char8_t, char16_t, char32_t and wchar_t, and any
instantiation for other types will fail.
This causes devel/binutils to fail to compile with clang 19 and libc++
19, resulting in errors similar to:
/usr/include/c++/v1/string:820:42: error: implicit instantiation of undefined template 'std::char_traits<unsigned short>'
820 | static_assert(is_same<_CharT, typename traits_type::char_type>::value,
| ^
./stringpool.h:225:35: note: in instantiation of template class 'std::basic_string<unsigned short>' requested here
225 | { return this->add_with_length(s.data(), s.size(), copy, pkey); }
| ^
stringpool.cc:530:7: note: in instantiation of member function 'gold::Stringpool_template<unsigned short>::add' requested here
530 | class Stringpool_template<uint16_t>;
| ^
/usr/include/c++/v1/__fwd/string.h:23:29: note: template is declared here
23 | struct _LIBCPP_TEMPLATE_VIS char_traits;
| ^
Upstream binutils has fixed this in commit 5e9091dab88 [2], so import it
as a separate patch, until the next version of binutils is released.
[1] https://libcxx.llvm.org/ReleaseNotes/19.html#deprecations-and-removals
[2] https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=5e9091dab88
PR: 280563
Approved by: cy (maintainer)
MFH: 2024Q3
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree
- Remove all references to defunct ARCH arm
- Remove all references to defunct ARCH sparc64
- Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64
ARCH
- Remove sysutils/afbinit requires defunct sparc64 ARCH
- Remove all references to bktr driver
- Remove all references to defunct FreeBSD_12
- Remove all references to OSVERSION/OSREL corresponding to 12
- Remove conditionals in Mk/Uses/cabal.mk
- Remove sparc reference from Mk/Uses/qt-dist.mk
- Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64
- Remove BROKEN_FreeBSD_12* from:
- Remove OpenSSL patches from:
- Remove conditional flags for OSVERSION >= 1300000 to fixed flags.
Also move conditional flags for non sparc64/arm ARCH to fixed flags.
Reviewed by: brooks, jbeich, rene, salvadore
Differential Revision: https://reviews.freebsd.org/D42068
devel/binutils: Disable randomly discovered libelf dependency
Users who build binutils from ports source will discover an implied
dependency for elfutils should elfutils be installed at the time
make is run.
PORTREVISION is not bumped because this bug does not affect building of
binary packages. The binary package never has an elfutils dependency
because elfutils is never installed in the poudriere jail prior to
building binutils. This avoids a gratuitous rebuild of binary packages
when none is needed.
PR: 273798
devel/binutils: fix build with lld 17
Some versioned symbols in libctf are undefined when libctf-nobfd.so is
linked. Suppress errors with lld >= 17 due to these undefined symbols.
PR: 273791
MFH: 2023Q3
devel/binutils: Revert "devel/binutils: Update to 2.41"
This was an accidental misoperation of git.
This reverts commit 14211774c4d7d56fd534d38748287ff270d0d469.
devel/binutils: Add GNU to MASTER_SITES
GNU mirrors also hosts binutils and as there are a lot more of those
set GNU as primary alias and fallback to SOURCEWARE
Reference:
https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00009.html
Approved by: portmgr (blanket)
devel/binutils: Fix abort() in mingw32
Building mingw32 results in a binutils abort() trap. Upstream commit
b7eab2a9d4f fixes this. Upstream commit log message states:
the early-out in wild_sort is not enough, it might still be
that filenames are equal _and_ the wildcard list doesn't specify
a sort order either. Don't call compare_section then.
PR: 271405
Reported by: shurd
Upstream commit: b7eab2a9d4f (identified by shurd)
MFH 2023Q3
devel/binutils: Setting sh_link for SHT_REL/SHT_RELA
Import upstream commit 6b958fe36b7:
It's wrong to have an alloc reloc section trying to use a non-alloc
symbol table.
* elf.c (assign_section_numbers <SHT_REL, SHT_RELA>): Correct
comment. Always set sh_link to .dynsym for alloc reloc
sections and to .symtab for non-alloc.
This also fixes strip when using llvm-strip, i.e. when base built with
WITH_LLVM_BINUTILS.
PR: 271061, see also: 270961, 270960
Reported by: Emanuel Haupt <ehaupt@FreeBSD.org>
Approved by: cy
Obtained from: Upstream commit 6b958fe36b7
MFH: 2022Q2
devel/binutils: Enable shared
The submittor's reason for this change is that shared libraries makes
dependencies easier to track. However, this is not the primary reason
to add shared library support. Shared libraries are more secure because
should a depending package, such as binutils, require a security update
any depending packages will immediately reap the benefit of the newly
secured package.
This change only affects the native flavor because when 2f26d37a5937
(SVN r517642) changed the port from slave ports of binutils to FLAVORS,
it mistakenly removed shared libraries from the native package. Prior to
this 2f26d37a5937 only non-native packages were built producing only
static libraries. This revision restores the behabviour of prior to
2f26d37a5937.
PR: 270146
Reported by: yuri
Fixes: 2f26d37a5937 (SVN r517642)
devel/binutils: Bring back ansidecl.h
A missing ansidecl.h is causing some ports build failures because of
and unknown ENUM_BITFIELD. This commit brings it back.
Previous commits which removed ansidecl.h, 8b115343ad84e and 95c499bbd7f34,
failed to say why the file was removed. We can only guess the reason, to
solve an undocumented problem at the time.
PR: 269878
Submitted by: yuri
Reported by: yuri
MFH: 2023Q1
devel/binutils: Update from 2.39 to 2.40
Update our binutils port from 2.39 to 2.40.
Enable zstd support. Depend on the port in case the port is newer
than base.
Additional contributions by dizzy@:
- Use DISTVERSION instead of PORTVERSION
- Drop (reset) PORTREVISION
- Define zstd as LIB_DEPENDS rather than DEPENDS
- Add USES= localbase pkgconfig to fix (lib)zstd detection
- Set zstd as default compression algorithm for compressed debug
sections
- Enable verbose output during build
- Drop STATIC option, it's unsupported upstream and fails to build
Also, disable tests because --compress-debug-sections is always set
to zlib-gabi regardless of the compression setting by ./configure,
resulting in failure.
Exp-run PR: 268994
Exp-run by: antoine
devel/binutils: Update from 2.37 to 2.39
Update our binutils port from 2.37 to 2.39. While at it change the distfile
from tar.xz to tar.lz, which is 4 MB smaller than the .xz version.
Exp-run PR: 265917
Exp-run by: antoine
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
devel/binutils: Take on maintainership
Typically the practice should be to assume maintainership while committing
other more substancial patches. However the planned update from 2.37 to
2.39 will require an exp-run. Let's do the MAINTAINER change first and do
the rest after the exp-run has been successfully completed.
Exp-run suggested by: danfe
devel/binutils: Reset MAINTAINER
Maintainer has not been responsive since he took maintainership of the port.
Reset MAINTAINER to reflect the real status of the port.
devel/binutils: Fix as, gprof, ld man pages
Fix several man pages by deleting them and forcing the software to regenerate
them.
PR: 265816
Reported by: lantw44@gmail.com
Approved by: jflopezfernandez@gmail.com (maintainer, implicit timeout)
devel/binutils: configure with --enable-new-dtags
This makes binutils ld use DT_RUNPATH instead of DT_RPATH by default
for FreeBSD targets and brings it in line with LLVM ld.
The difference between the two is that DT_RUNPATH has a lower priority
than the LD_LIBRARY_PATH environment variable. This variable is used
by libtool to override DT_RUNPATH when running programs directly from
the build directory (e.g. during make test).
PR: 259446
Approved by: maintainer timeout (2 weeks)
*/*: Remove redundant '-[0-9]*' from CONFLICTS
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Many CONFLICTS definitions used patterns like "bash-[0-9]*" to filter
for the bash package in any version. But that pattern is functionally
identical with just "bash".
Approved by: portmgr (blanket)
devel/binutils: Fix manpage generation after 2.37
A bug[1] upstream in 2.37 left empty man pages after build.
The downloaded distribution file comes with empty man pages too.
Apply patch from upstream[1] and force man page regeration by removing the ones
which come with the distribution.
[1] https://sourceware.org/bugzilla/show_bug.cgi?id=28144
[1] https://sourceware.org/bugzilla/show_bug.cgi?id=28144#c3
PR: 257982
Reported by: jbeich@
devel/binutils: Apply upstream patch to fix "undefined symbol: bswap_identity_64" and similar errors, when building devel/binutils in certain environments.
This has been sitting in a bug for almost a year now without any action,
which is why I am committing it now.
MFH: 2020Q4
PR: 250783
devel/binutils: fix gnu as on powerpc64le
as built big-endian binaries on powerpc64le without this patch.
This makes www/firefox build correctly.
Submitted by: bdragon@
devel/binutils: fix build with -fno-common
Add a patch from upstream to fix the build of devel/binutils when compiled
with -fno-common, which is the default with llvm 11.
PR: 248701
MFH: 2020Q3