binutils Newspaper
JUNE 15, 2026
Date
/
Architectures
Components
Topics
News & Policy
Other
binutils/gas

Fix for `s_comm_internal` uninitialized access in GAS.

GAS now avoids uninitialized access in `s_comm_internal` by preventing double-calls to line-ending consumption functions after errors.

This commit addresses a bug in the GNU Assembler (GAS) where s_comm_internal could attempt to access uninitialized memory. The issue arose when elf_common_parse called ignore_rest_of_line after an error, and then s_comm_internal subsequently called demand_empty_rest_of_line. Both functions consume the end-of-statement character, leading the second call to potentially read from an invalid memory region. The fix prevents elf_common_parse from calling ignore_rest_of_line to avoid this double-consumption and ensure correct input parsing.

In Details

This Binutils GAS commit resolves an uninitialized access bug in s_comm_internal during the parsing of common symbols in obj-elf.c. The problem occurred when elf_common_parse invoked ignore_rest_of_line upon encountering certain errors. Subsequently, s_comm_internal would sometimes call demand_empty_rest_of_line. Both ignore_rest_of_line and demand_empty_rest_of_line consume the input buffer's end_of_stmt character. This double consumption could lead to demand_empty_rest_of_line attempting to read past the buffer limit or into uninitialized memory, causing a crash. The fix…

For Context

The GNU Assembler (GAS) converts assembly code into machine executable instructions. When GAS processes a line of assembly code, it often needs to ensure that a statement ends correctly. This commit fixes a subtle bug where, under specific error conditions during the parsing of 'common' symbols (shared variables), two different parts of the assembler (elf_common_parse and s_comm_internal) would both try to consume the end-of-line marker. This 'double consumption' could cause one of them to read past the actual end of the input, leading to unexpected behavior or crashes. The fix ensures that only one part of the assembler handles the end-of-line marker in these situations, making the assembler more robust.

Filed Under: bugfixassemblermemory safety