Fix CVE-2026-19582 - a potential buffer overflow in rsrc_resource_name.
BFD's PE resource-name printer now bounds-checks its output, closing a buffer-overflow CVE.
The patch replaces unbounded sprintf calls in rsrc_print_name and related helpers with length-checked snprintf, preventing an attacker-controlled PE resource name from overwriting stack or heap buffers during objdump or linker invocations. The 116-line expansion adds two new helper functions, rsrc_string_print_str and rsrc_string_print_int, that track remaining buffer capacity and bail early if truncation would occur. Because malformed PE/COFF resource sections are common in the wild—both from fuzzing and legitimate but exotic toolchains—this fix defends a critical parsing path that every BFD consumer inherits.
In Details
BFD's peXXigen.c implements PE/COFF-specific handlers for the resource section (.rsrc), a tree-structured table of icons, manifests, and other embedded data indexed by type, name, and language. The rsrc_print_name function formats Unicode resource names for diagnostic output; prior to this commit it used sprintf with a fixed-size caller-allocated buffer and no bounds enforcement, trusting the rsrc_string length field parsed from untrusted input. The overflow surfaces when BFD processes any PE binary—objdump -x, the linker merging .rsrc sections, or even GDB reading debug symbols…
- BFD
- Binary File Descriptor library—the shared object-format abstraction inside binutils and GDB. BFD provides a uniform API to read, write, and manipulate ELF, PE/COFF, Mach-O, and dozens of other formats so higher-level tools need not reimplement parsers.
- PE/COFF
- Portable Executable / Common Object File Format—the native binary and object format for Windows and UEFI. PE wraps COFF with additional headers for sections like
.rsrc(resources),.reloc(base relocations), and import/export tables. - .rsrc section
- The resource section in a PE binary, holding icons, manifests, version strings, and dialogs as a tree of directories and data entries. Each entry may be named (Unicode string) or numbered (ID), and the linker must merge and de-duplicate
.rsrctrees from multiple object files. - peXXigen.c
- BFD's PE/COFF generator/parser, using XX as a stand-in for 32 or 64. It implements section-specific logic—
.rsrcmerging, import-table fixups, base relocations—that generic BFD cannot handle. Lives inbfd/and is compiled twice (pe-i386.c / pei-x86-64.c) with different pointer widths. - rsrc_string
- A BFD-internal structure pairing a pointer to a byte array with a length field. Used to represent resource names parsed from the
.rsrcdirectory; the string may be UTF-16LE and is not guaranteed null-terminated, so all accesses must respect the length. - CVE-2026-19582
- The assigned CVE identifier for this buffer-overflow vulnerability in
rsrc_print_name. An attacker embedding a crafted resource name in a PE file could trigger out-of-bounds writes when BFD formats diagnostic output, leading to denial-of-service or potential code execution in toolchain processes.