Fix use-after-free in archive symbol map loader that corrupted linker searches
Plugs a use-after-free in BFD's archive symbol map code that freed map entries prematurely, breaking linker symbol lookups.
The linker’s archive symbol map loader _bfd_load_armap was freeing the symbol map entries immediately after creating them, leaving dangling pointers that could crash or misbehave during later symbol resolution. This happened because _bfd_compute_and_push_armap called bfd_release to free objalloc memory starting from a dummy allocation, inadvertently discarding the just-loaded map. The patch also simplifies struct orl by removing the redundant name pointer indirection and the namidx field, which can be recalculated on demand during armap serialization. This fix was discovered while addressing CVE-2026-19548 and prevents silent corruption of linker symbol tables for mapless archives.
In Details
BFD's archive symbol map (armap) is the in-memory index bfd keeps so the linker can resolve symbols from static archives without scanning every member. _bfd_load_armap populates this index from archive headers, allocating struct orl entries via objalloc. _bfd_compute_and_push_armap orchestrates fallback map generation when headers are missing, but its cleanup logic—bfd_release from a first_name marker—was freeing the map right after _bfd_load_armap returned. The orl structure holds per-symbol metadata (file position or member BFD pointer, name, namidx) for armap writers; the r…
- BFD
- Binary File Descriptor library, the core abstraction layer in binutils that presents a uniform API over object files, executables, archives, and core dumps regardless of format (ELF, COFF, XCOFF, etc.).
- armap
- Archive symbol map, an index stored at the front of a static library (
.a) that maps global symbols to the archive members that define them, enabling the linker to extract only the needed.ofiles without scanning every entry. - _bfd_load_armap
- BFD function that parses an existing armap from an archive's header and loads it into the in-memory
struct orlarray for fast linker symbol lookups. - _bfd_compute_and_push_armap
- BFD orchestrator function that either loads an existing armap via
_bfd_load_armapor builds one by iterating archive members, then passes the map to format-specific writers. - struct orl
- Archive symbol map entry structure in BFD, holding a symbol name and either a file offset or a pointer to the member BFD that defines it. Used internally during armap generation and serialization.
- objalloc
- BFD's arena allocator for per-BFD temporary data. Memory is freed in bulk with
bfd_releasefrom a checkpoint, which makes it fast but requires careful ordering to avoid freeing live data. - use-after-free
- Memory-safety bug where code accesses a pointer after the backing allocation has been freed. In this case, armap entries were freed before the linker finished symbol resolution, leaving dangling pointers that could crash or corrupt data structures.