Landing: d9ab6e42e739
Project / Subsystem
binutils / bfd/archive
Date
2026-08-17
Author
Alan Modra <amodra@sourceware.org>
Commit
d9ab6e42e739fe826b02a5f868586132ea2d893a
Source
public_inbox
Perf win
No
Breaking
No
All attributes
- project
- binutils
- subsystem
- bfd/archive
- patch_id
- —
- commit_hash
- d9ab6e42e739fe826b02a5f868586132ea2d893a
- source_type
- public_inbox
- headline
- Fix use-after-free in archive symbol map loader that corrupted linker searches
- tldr
- Plugs a use-after-free in BFD's archive symbol map code that freed map entries prematurely, breaking linker symbol lookups.
- author
- Alan Modra <amodra@sourceware.org>
- outcome
- committed
- performance_win
- false
- breaking_change
- false
- series_id
- —
- series_parts
- []
- tags
-
- • security
- • memory-safety
- • archive
- • linker
- • CVE
- discussion_id_link
- —
- bugzilla_pr
- —
- date
- 2026-08-17T00:00:00.000Z
The linker’s archive symbol map loader _bfd_load_armap was freeing the symbol map entries immediately after creating them, leaving dangling pointers that could crash or misbehave during later symbol resolution. This happened because _bfd_compute_and_push_armap called bfd_release to free objalloc memory starting from a dummy allocation, inadvertently discarding the just-loaded map. The patch also simplifies struct orl by removing the redundant name pointer indirection and the namidx field, which can be recalculated on demand during armap serialization. This fix was discovered while addressing CVE-2026-19548 and prevents silent corruption of linker symbol tables for mapless archives.