Fix CVE-2026-19582: PE resource section buffer overflow
Fixes a buffer overflow in PE resource section parsing by using a dynamic string buffer.
A security vulnerability (CVE-2026-19582) in binutils allowed a buffer overflow when parsing malformed PE files. The peXXigen.c:rsrc_sort_entries() function used a fixed-size buffer for error messages, which could be overflowed by crafted input. The fix replaces the static buffer with a dynamic rsrc_string structure to manage buffer space more safely, although the vulnerability is considered unlikely to be exploited in practice.
- proposer
Applies a patch to fix a CVE-related buffer overflow in PE resource section parsing.
“This is an annoying, not really valid as a CVE, bug which is based upon the fact that peXXigen.c:rsrc_sort_entries() uses a fixed size static buffer for constructing error messages. A specially crafted (and invalid) PE format input file could trigger a buffer overflow potentially causing the linker to crash. The fix I have chosen is to change the buffer into a rsrc_string structure and to use t…”
- reviewer
Suggests using `bfd_asprintf` as a simpler alternative to the proposed `rsrc_string` solution.
“Wouldn't it be easier to use bfd_asprintf?”
- proposer
Responds that `bfd_asprintf` might have been simpler in hindsight but explains the chosen approach.
“In hindsight - maybe ? The problem with bfd_asprintf() and similar functions is that they do not handle i”
- other
Agrees with Nick Clifton's assessment of `bfd_asprintf`'s limitations in this context.
“In hindsight - maybe ? The problem with bfd_asprintf() and similar functi”
Technical Tradeoffs
- Fixes a security vulnerability, improving robustness.
- The chosen fix might be considered 'faffy' or overly complex for a low-probability issue.
- Alternative solutions like `bfd_asprintf` were considered but potentially dismissed due to unstated reasons.
In Details
This commit addresses a buffer overflow vulnerability in the PE file parser within binutils' BFD library. The issue arises from rsrc_sort_entries() in peXXigen.c using a fixed-size buffer for error message construction, which can be overflowed by malicious PE input. The proposed fix modifies this to use a dynamically sized rsrc_string buffer.
- PE file
- Portable Executable. The file format used for executables, object code, DLLs, and system files in Windows operating systems.
- CVE-2026-19582
- A Common Vulnerabilities and Exposures identifier for a specific security flaw in the binutils software.
- BFD
- Binary File Descriptor library. A low-level library used by binutils to support various executable file formats.
- rsrc_string
- A data structure likely used within binutils for managing dynamically sized strings, particularly for error messages or resource handling in PE files.
- bfd_asprintf
- A function within the BFD library that dynamically allocates memory for a formatted string, similar to the standard C
asprintffunction.