ld/pdb: Avoid double-free on malformed symbol data
Fixes a double-free bug in linker's PDB generation when handling malformed symbol data.
This patch corrects a double-free error in the linker’s PDB (Program Database) generation. The issue occurred when handle_debugs_section failed, causing create_module_info_substream to free file arrays for all modules, including the current one. Subsequently, populate_module_stream would also attempt to free the same array, leading to the double-free. The fix ensures that the cleanup of the current module’s file array is handled only once by the caller.
- reviewer
Acknowledges and accepts the proposed fix.
“Okay.”
- proposer
Explains that the current module's file array was being freed twice upon failure and proposes to leave its cleanup to the caller.
“When handle_debugs_section fails, create_module_info_substream frees the file arrays for all modules, including the current one. Do not free the current array in populate_module_stream as well.”
Technical Tradeoffs
- Addresses a critical memory safety issue.
- Minor change to error handling logic.
In Details
This patch addresses a memory corruption bug (double-free) in the linker's PDB generation for Windows executables. The defect arises in ld/pdb.c within the populate_module_stream function. If handle_debugs_section encounters an error, create_module_info_substream frees the mod_source->files array. populate_module_stream would then also attempt to free this same array, causing a double-free. The fix modifies populate_module_stream to avoid this redundant free, relying on the caller to manage the memory.
- PDB
- Program Database. A file format used by Microsoft Windows to store information about executable files, used by debuggers and other tools.
- linker
- A program that combines object code from multiple sources into a single executable or library.
- double-free
- A memory corruption error that occurs when memory is freed more than once.