Fix double free in _bfd_stab_section_find_nearest_line
Corrects a double-free bug in BFD's stab section handling by nullifying freed memory and adjusting error paths.
This commit fixes a double-free vulnerability in the _bfd_stab_section_find_nearest_line function within BFD’s symbol handling. It ensures that memory pointed to by reloc_vector is set to NULL after being freed, preventing subsequent attempts to free the same memory. Additionally, it corrects an error goto path to prevent the issue from occurring even in cases of incorrect control flow.
In Details
Fixes a use-after-free (specifically, double-free) in bfd/syms.c within _bfd_stab_section_find_nearest_line. When an error occurs after reloc_vector is freed, a goto statement could lead to freeing reloc_vector again. This patch nullifies reloc_vector after the first free and corrects the goto target to prevent the double-free.
- double-free
- A programming error where memory that has already been freed is freed again. This can corrupt memory management structures and lead to crashes or security vulnerabilities.
- BFD
- The Binary File Descriptor library, a low-level API for reading and writing various binary file formats used by GNU Binutils.
- stab
- Symbol table information, a debugging format predating DWARF. STABS are often embedded in object files to provide information for debuggers.