[to-be-committed v2] PR ld/24600: BFD: Fix use-after-free from `_bfd_load_armap'
Project / Subsystem
binutils / binutils
Date
2026-08-14
Proposer
"Maciej W. Rozycki" <macro@orcam.me.uk>
Source type
public_inbox
Consensus
Committed
Sentiment
8/10
Technical tradeoffs
- • Improved memory safety by fixing use-after-free vs. potential minor increase in temporary memory usage during archive processing.
All attributes
- project
- binutils
- subsystem
- binutils
- patch_id
- —
- discussion_id
- alpine.DEB.2.21.2608142347340.14132@angie.orcam.me.uk
- source_type
- public_inbox
- title
- [to-be-committed v2] PR ld/24600: BFD: Fix use-after-free from `_bfd_load_armap'
- headline
- BFD: Fix use-after-free from `_bfd_load_armap'
- tldr
- Fixes a use-after-free vulnerability in BFD's archive handling related to symbol map allocation.
- proposer
- "Maciej W. Rozycki" <macro@orcam.me.uk>
- consensus
- Committed
- outcome
- committed
- sentiment_score
- 8
- technical_tradeoffs
-
- • Improved memory safety by fixing use-after-free vs. potential minor increase in temporary memory usage during archive processing.
- series_id
- PR ld/24600
- series_role
- cover
- series_parts
- []
- tags
-
- • security
- • vulnerability
- • bfd
- • binutils
- • memory corruption
- bugzilla_url
- —
- date
- 2026-08-14T00:00:00.000Z
[to-be-committed v2] PR ld/24600: BFD: Fix use-after-free from `_bfd_load_armap'
This patch, a revision of a previous version, addresses a use-after-free vulnerability in the BFD library’s handling of archive symbol maps. The issue stems from memory allocated for symbol map entries being prematurely freed. The fix restructures the `_bfd_compute_and_push_armap’ function to manage temporary name pointers within local objalloc, ensuring that actual name strings are retained correctly and preventing the use-after-free condition. This addresses CVE-2026-19548.