new file mode 100644

@@ -0,0 +1,95 @@

+From 8abac8031ed369a2734b1cdb7df28a39a54b4b49 Mon Sep 17 00:00:00 2001

+From: Alan Modra <amodra@gmail.com>

+Date: Wed, 20 Feb 2019 08:21:24 +1030

+Subject: [PATCH] PR24236, Heap buffer overflow in

+ _bfd_archive_64_bit_slurp_armap

+

+	PR 24236

+	* archive64.c (_bfd_archive_64_bit_slurp_armap): Move code adding

+	sentinel NUL to string buffer nearer to loop where it is used.

+	Don't go past sentinel when scanning strings, and don't write

+	NUL again.

+	* archive.c (do_slurp_coff_armap): Simplify string handling to

+	archive64.c style.

+---

+ bfd/archive.c   | 17 +++++++----------

+ bfd/archive64.c | 10 +++++-----

+ 2 files changed, 12 insertions(+), 15 deletions(-)

+

+diff --git a/bfd/archive.c b/bfd/archive.c

+index d2d9b72..68a92a3 100644

+--- a/bfd/archive.c

+@@ -1012,6 +1012,7 @@ do_slurp_coff_armap (bfd *abfd)

+   int *raw_armap, *rawptr;

+   struct artdata *ardata = bfd_ardata (abfd);

+   char *stringbase;

++  char *stringend;

+   bfd_size_type stringsize;

+   bfd_size_type parsed_size;

+   carsym *carsyms;

+@@ -1071,22 +1072,18 @@ do_slurp_coff_armap (bfd *abfd)

+     }

+ 

+   /* OK, build the carsyms.  */

+-  for (i = 0; i < nsymz && stringsize > 0; i++)

++  stringend = stringbase + stringsize;

++  *stringend = 0;

++  for (i = 0; i < nsymz; i++)

+     {

+-      bfd_size_type len;

+-

+       rawptr = raw_armap + i;

+       carsyms->file_offset = swap ((bfd_byte *) rawptr);

+       carsyms->name = stringbase;

+-      /* PR 17512: file: 4a1d50c1.  */

+-      len = strnlen (stringbase, stringsize);

+-      if (len < stringsize)

+-	len ++;

+-      stringbase += len;

+-      stringsize -= len;

++      stringbase += strlen (stringbase);

++      if (stringbase != stringend)

++	++stringbase;

+       carsyms++;

+     }

+-  *stringbase = 0;

+ 

+   ardata->symdef_count = nsymz;

+   ardata->first_file_filepos = bfd_tell (abfd);

+diff --git a/bfd/archive64.c b/bfd/archive64.c

+index 312bf82..42f6ed9 100644

+--- a/bfd/archive64.c

+@@ -100,8 +100,6 @@ _bfd_archive_64_bit_slurp_armap (bfd *abfd)

+     return FALSE;

+   carsyms = ardata->symdefs;

+   stringbase = ((char *) ardata->symdefs) + carsym_size;

+-  stringbase[stringsize] = 0;

+-  stringend = stringbase + stringsize;

+ 

+   raw_armap = (bfd_byte *) bfd_alloc (abfd, ptrsize);

+   if (raw_armap == NULL)

+@@ -115,15 +113,17 @@ _bfd_archive_64_bit_slurp_armap (bfd *abfd)

+       goto release_raw_armap;

+     }

+ 

++  stringend = stringbase + stringsize;

++  *stringend = 0;

+   for (i = 0; i < nsymz; i++)

+     {

+       carsyms->file_offset = bfd_getb64 (raw_armap + i * 8);

+       carsyms->name = stringbase;

+-      if (stringbase < stringend)

+-	stringbase += strlen (stringbase) + 1;

++      stringbase += strlen (stringbase);

++      if (stringbase != stringend)

++	++stringbase;

+       ++carsyms;

+     }

+-  *stringbase = '\0';

+ 

+   ardata->symdef_count = nsymz;

+   ardata->first_file_filepos = bfd_tell (abfd);

+-- 

+2.9.3

new file mode 100644

@@ -0,0 +1,32 @@

+From 7fc0c668f2aceb8582d74db1ad2528e2bba8a921 Mon Sep 17 00:00:00 2001

+From: Nick Clifton <nickc@redhat.com>

+Date: Wed, 20 Feb 2019 17:03:47 +0000

+Subject: [PATCH] Fix a illegal memory access fault when parsing a corrupt MIPS

+ option section using readelf.

+

+	PR 24243

+	* readelf.c (process_mips_specific): Check for an options section

+	that is too small to even contain a single option.

+---

+ binutils/readelf.c | 6 ++++++

+ 1 files changed, 6 insertions(+)

+

+diff --git a/binutils/readelf.c b/binutils/readelf.c

+index 54d165e..20ebacc 100644

+--- a/binutils/readelf.c

+@@ -16187,6 +16187,12 @@ process_mips_specific (Filedata * filedata)

+ 	  error (_("No MIPS_OPTIONS header found\n"));

+ 	  return FALSE;

+ 	}

++      /* PR 24243  */

++      if (sect->sh_size < sizeof (* eopt))

++	{

++	  error (_("The MIPS options section is too small.\n"));

++	  return FALSE;

++	}

+ 

+       eopt = (Elf_External_Options *) get_data (NULL, filedata, options_offset, 1,

+                                                 sect->sh_size, _("options"));

+-- 

+2.9.3

@@ -1,7 +1,7 @@

 Summary:        Contains a linker, an assembler, and other tools

 Name:           binutils

 Version:        2.31

-Release:        3%{?dist}

+Release:        4%{?dist}

 License:        GPLv2+

 URL:            http://www.gnu.org/software/binutils

 Group:          System Environment/Base

@@ -15,6 +15,8 @@ Patch2:         binutils-CVE-2018-18607.patch

 Patch3:         binutils-CVE-2018-18606.patch

 Patch4:         binutils-CVE-2018-19931.patch

 Patch5:         binutils-CVE-2018-1000876.patch

+Patch6:         binutils-CVE-2019-9075.patch

+Patch7:         binutils-CVE-2019-9077.patch

 %description

 The Binutils package contains a linker, an assembler,

@@ -35,6 +37,8 @@ for handling compiled objects.

 %patch3 -p1

 %patch4 -p1

 %patch5 -p1

+%patch6 -p1

+%patch7 -p1

 %build

 install -vdm 755 ../binutils-build

@@ -123,6 +127,8 @@ make %{?_smp_mflags} check

 %{_libdir}/libopcodes.so

 %changelog

+*   Thu Mar 14 2019 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 2.31-4

+-   Fix CVE-2019-9075 and CVE-2019-9077

 *   Wed Feb 13 2019 Alexey Makhalov <amakhalov@vmware.com> 2.31-3

 -   Fix CVE-2018-19931 and CVE-2018-1000876

 *   Wed Jan 02 2019 Ankit Jain <ankitja@vmware.com> 2.31-2