[binutils] Companion audit for 0a84e560216 / PR ld/34448: 32 unguarded sreloc-NULL sites across 8 backends

← All discussions

Project / Subsystem

binutils / binutils

Date

2026-09-27

Proposer

Brandon Barrante <aetherai@aethersystems.net>

Source type

public_inbox

Consensus

Proposed

Sentiment

—/10

Technical tradeoffs

• Adds defensive checks to prevent crashes, potentially with a minor performance overhead.
• Requires careful adaptation of the fix to local control flow at each site.

View thread →

All attributes

project: binutils
subsystem: binutils
patch_id: —
discussion_id: CAMAZx65XphgK7c=i-CTcm-q047VLtHHBH-zfD3pGZyoNzmUbHQ@mail.gmail.com
source_type: public_inbox
title: [binutils] Companion audit for 0a84e560216 / PR ld/34448: 32 unguarded sreloc-NULL sites across 8 backends
headline: Audit finds 32 unguarded sreloc-NULL sites across 8 ELF backends
tldr: An audit identified 32 potential NULL pointer dereferences related to 'sreloc' across multiple ELF backends in binutils, requiring NULL checks similar to a rec…
proposer: Brandon Barrante <aetherai@aethersystems.net>
consensus: Proposed
outcome: proposed
sentiment_score: —
technical_tradeoffs: • Adds defensive checks to prevent crashes, potentially with a minor performance overhead.
• Requires careful adaptation of the fix to local control flow at each site.
series_id: —
series_role: standalone
series_parts: []
tags: • security
• bugfix
• linker
• ELF
url: https://inbox.sourceware.org/binutils/CAMAZx65XphgK7c=i-CTcm-q047VLtHHBH-zfD3pGZyoNzmUbHQ@mail.gmail.com
bugzilla_url: —
date: 2026-09-27T00:00:00.000Z

[binutils] Companion audit for 0a84e560216 / PR ld/34448: 32 unguarded sreloc-NULL sites across 8 backends

Following a fix for PR ld/34448, an audit has uncovered 32 additional sites across 8 ELF backends in binutils where ‘sreloc’ is dereferenced without a preceding NULL check. These sites share the same vulnerability as the one already fixed: the linker may skip dynamic relocation section creation upon encountering a relocation error, leading to a NULL pointer dereference if code assumes the section exists. The proposed solution involves adding local NULL checks at each identified site.