RFC: Fix for CVE-2026-19548
Fixes a memory leak in the archive processing logic that could lead to a crash or denial of service.
This RFC proposes a fix for a memory leak identified in the archive processing logic, specifically related to the _bfd_compute_and_push_armap function. The issue arises from a premature bfd_release call, causing memory allocated for ardata->symdefs to be lost. The proposed solution involves using a local objalloc structure instead of attaching it to the archive BFD.
- proposer
Identifies a memory leak in archive processing and proposes a fix using a local objalloc structure.
“Good catch! Since `_bfd_compute_and_push_armap' uses `bfd_alloc' for temporary storage only, I think the best way to get this sorted will be just using a local objalloc structure rather than attaching it to the archive BFD.”
In Details
A memory leak exists in the BFD library's archive handling, specifically within _bfd_compute_and_push_armap. The function incorrectly calls bfd_release on an objalloc structure that holds critical symdefs data, leading to a use-after-free condition or crash. The proposed fix uses a local objalloc for temporary storage, preventing this premature release and potential vulnerability.
- BFD
- Binary File Descriptor library, used by GNU Binutils to interact with object file formats.
- archive BFD
- A Binary File Descriptor representing an archive file (e.g., .a, .lib), allowing access to its members.
- objalloc
- An object allocator within BFD, used for managing memory for intermediate data structures during file processing.
- symdefs
- Symbol definitions, which are essential data structures containing information about symbols in an object file or archive.
- CVE-2026-19548
- A vulnerability identifier, in this case related to a security flaw in the binutils archive handling.