[to-be-committed] PR ld/24600: BFD: Fix use-after-free from `_bfd_load_armap'
Project / Subsystem
binutils / binutils
Date
2026-08-14
Proposer
"Maciej W. Rozycki" <macro@orcam.me.uk>
Source type
public_inbox
Consensus
Committed
Sentiment
9/10
Technical tradeoffs
- • Improved memory safety by fixing use-after-free vs. using local objalloc for temporary allocations, potentially increasing peak memory usage during archive processing.
All attributes
- project
- binutils
- subsystem
- binutils
- patch_id
- —
- discussion_id
- alpine.DEB.2.21.2608141637320.14132@angie.orcam.me.uk
- source_type
- public_inbox
- title
- [to-be-committed] PR ld/24600: BFD: Fix use-after-free from `_bfd_load_armap'
- headline
- BFD: Fix use-after-free from `_bfd_load_armap'
- tldr
- Fixes a use-after-free vulnerability in BFD's archive handling related to symbol map allocation.
- proposer
- "Maciej W. Rozycki" <macro@orcam.me.uk>
- consensus
- Committed
- outcome
- committed
- sentiment_score
- 9
- technical_tradeoffs
-
- • Improved memory safety by fixing use-after-free vs. using local objalloc for temporary allocations, potentially increasing peak memory usage during archive processing.
- series_id
- PR ld/24600
- series_role
- cover
- series_parts
- []
- tags
-
- • security
- • vulnerability
- • bfd
- • binutils
- • memory corruption
- bugzilla_url
- —
- date
- 2026-08-14T00:00:00.000Z
[to-be-committed] PR ld/24600: BFD: Fix use-after-free from `_bfd_load_armap'
This patch addresses a use-after-free vulnerability in the BFD library concerning archive symbol map handling. The issue arose from memory allocated for symbol map entries being freed prematurely. The proposed solution utilizes local objalloc within _bfd_compute_and_push_armap for temporary symbol name pointers, ensuring that permanent name strings are correctly retained and preventing the memory corruption. This fix targets CVE-2026-19548 and is a refactoring of existing code that dates back to 1994.