diff --git a/meta/recipes-devtools/binutils/binutils-2.22.inc b/meta/recipes-devtools/binutils/binutils-2.22.inc
index 9697242..94cd17f 100644
--- a/meta/recipes-devtools/binutils/binutils-2.22.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.22.inc
@@ -1,4 +1,4 @@
-PR = "r17"
+PR = "r18"
 
 LIC_FILES_CHKSUM="\
     file://src-release;endline=17;md5=4830a9ef968f3b18dd5e9f2c00db2d35\
@@ -45,6 +45,7 @@ SRC_URI = "\
      file://0144-timer.cc-include-unistd.h.patch \
      file://0166-2012-04-27-Doug-Kwan-dougkwan-google.com.patch \
      file://0182-PR-ld-13991.patch \
+     file://binutils-check-size-before-memset.patch \
      "
 
 SRC_URI[md5sum] = "ee0f10756c84979622b992a4a61ea3f5"
diff --git a/meta/recipes-devtools/binutils/binutils/binutils-check-size-before-memset.patch b/meta/recipes-devtools/binutils/binutils/binutils-check-size-before-memset.patch
new file mode 100644
index 0000000..0baf42e
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/binutils-check-size-before-memset.patch
@@ -0,0 +1,43 @@
+bfd/oasys.c: check size before memset
+
+On Ubuntu 12.10 /usr/include/x86_64-linux-gnu/bits/string3.h:77
+
+__extern_always_inline void *
+__NTH (memset (void *__dest, int __ch, size_t __len))
+{
+  if (__builtin_constant_p (__len) && __len == 0
+      && (!__builtin_constant_p (__ch) || __ch != 0)) 
+    {   
+      __warn_memset_zero_len (); 
+      return __dest;
+    }   
+  return __builtin___memset_chk (__dest, __ch, __len, __bos0 (__dest));
+}
+
+The "memset(void *s, int c, size_t n)" will warn if the "n" is zero,
+check the value of "n" before memset will fix the problem.
+
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+
+Upstream-Status: Pending
+---
+ binutils-2.22/bfd/oasys.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/bfd/oasys.c b/bfd/oasys.c
+--- a/bfd/oasys.c
++++ b/bfd/oasys.c
+@@ -908,7 +908,9 @@ oasys_write_header (bfd *abfd)
+     length = sizeof (r.module_name);
+ 
+   (void) memcpy (r.module_name, abfd->filename, length);
+-  (void) memset (r.module_name + length, ' ', sizeof (r.module_name) - length);
++
++  if (sizeof (r.module_name) > length)
++    (void) memset (r.module_name + length, ' ', sizeof (r.module_name) - length);
+ 
+   r.version_number = OASYS_VERSION_NUMBER;
+   r.rev_number = OASYS_REV_NUMBER;
+-- 
+1.7.10.4
+