Re: binutils CVEs

[Ludovic Courtès]

Marius Bakke <address@hidden> skribis:

> Efraim Flashner <address@hidden> writes:
>
>> On September 17, 2017 9:25:11 PM GMT+03:00, Marius Bakke <address@hidden> 
>> wrote:
>>>Efraim Flashner <address@hidden> writes:
>>>
>>>> There's a large number of CVEs against address@hidden Gentoo¹ has a
>>>nice
>>>> long list of the CVEs, and I've put together a patch to graft a
>>>> replacement, but I'm getting grafting errors:
>>>> ERROR: replacement length differs from the original length
>>>"h9nqlf0c82c1sds4yzs60k7pm4f37si2-binutils-2.28"
>>>"wl5dg3dnqvk2v2ahh5iadnv1s34rsbb6-binutils-2.28.1"
>>>
>>>This is because the replacement name is two bytes longer (.1).
>>>
>>>To fix it, the version field of the replacement must be set to
>>>something
>>>with equal length of "2.28".  I suppose we can use just that and
>>>hard-code the source URL?
>>
>> That is the obvious solution, but I don't like it. It does make it harder to 
>> verify that it's grafted correctly but I guess it'll just have to be that 
>> way.
>
> Maybe "2281".  Or "fixd".

Or “2.2A”?

Ludo’.