Hi Daiel,

Best to use the newer versions, lets archive GCC8.

Fwiw, Intel are at GCC10 now - it's in the CI containers too.

Will be moving to GCC11 when it's out since it has built in static analysis as discussed at TSC.

Liam

On Fri, 2021-04-02 at 10:13 +0000, Daniel Baluta wrote:

Hi Liam,

sof-gcc8.1 branch of crosstool-ng fails to build a cross compiler (i think for all platforms) because expat version 2.2.5 ( CT_EXPAT_VERSION="2.2.5" ) is vulnerable.

https://sourceforge.net/projects/expat/files/expat/2.2.5/expat-2.2.5-RENAMED...

What's your take on this? Should we change the config files to upgrade expat to 2.3.0 or should we directly use newer versions of gcc.

What gcc toolchain versions is Intel using? We at NXP want to align with that.

thanks, Daniel.

--------------------------------------------------------------------- Intel Corporation (UK) Limited Registered No. 1134945 (England) Registered Office: Pipers Way, Swindon SN3 1RJ VAT No: 860 2173 47

This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.