https://sourceware.org/bugzilla/show_bug.cgi?id=24600
--- Comment #10 from Sourceware Commits <cvs-commit at gcc dot gnu.org> --- The master branch has been updated by Alan Modra <[email protected]>: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d9ab6e42e739fe826b02a5f868586132ea2d893a commit d9ab6e42e739fe826b02a5f868586132ea2d893a Author: Alan Modra <[email protected]> Date: Sat Aug 15 00:17:56 2026 +0100 PR ld/24600: BFD: Fix use-after-free from `_bfd_load_armap' Fix an issue in commit e34fd4bfa6d7 ("PR ld/24600: BFD: Add general linker support for mapless archives") where the symbol map created by `_bfd_load_armap' has its entries discarded by a call to `bfd_release' after return to `_bfd_compute_and_push_armap' where all objalloc memory is freed that came starting from the dummy `first_name' allocation. This has been found in the context of CVE-2026-19548, <https://nvd.nist.gov/vuln/detail/CVE-2026-19548>. Also remove the "name" indirection in struct orl as that pointer is never modified so we are just wasting memory, and remove "namidx" too as that can easily be recalculated when writing an armap. Co-Authored-By: Maciej W. Rozycki <[email protected]> PR ld/24600 * archive.c (struct orl): Remove "name" indirection. Delete "namidx". (_bfd_load_armap): Don't copy name. (_bfd_compute_and_push_armap): Adjust for struct orl changes. Use memcpy rather than strcpy when copying symbol name. Don't release bfd_alloc'd memory when keep_symdefs. (_bfd_bsd_write_armap): Calculate namidx from names. Adjust for struct orl "name" change. (_bfd_coff_write_armap): Adjust for struct orl "name" change. * archive64.c (_bfd_archive_64_bit_write_armap): Likewise. * coff-rs6000.c (xcoff_write_armap_old): Likewise. (xcoff_write_armap_big): Likewise. * ecoff.c (_bfd_ecoff_write_armap): Calculate namidx from names. Adjust for struct orl "name" change. * libbfd.h: Regenerate. -- You are receiving this mail because: You are on the CC list for the bug.
