diff mbox series

Subject: [PATCH] bfd: avoid double free in _bfd_stab_section_find_nearest_line on the out-of-memory path

Message ID 5b41acb2.997fa.1a044491757.Coremail.zkd18cjb@mail.ustc.edu.cn
State New
Headers
Series Subject: [PATCH] bfd: avoid double free in _bfd_stab_section_find_nearest_line on the out-of-memory path |

Checks

Context Check Description
linaro-tcwg-bot/tcwg_binutils_build--master-arm fail Patch failed to apply
linaro-tcwg-bot/tcwg_binutils_build--master-aarch64 fail Patch failed to apply

Commit Message

zkd18cjb@mail.ustc.edu.cn Aug. 27, 2026, 5:33 p.m. UTC 
  Hello binutils maintainers,

This is a robustness fix for a double free in
_bfd_stab_section_find_nearest_line (bfd/syms.c): the normal path
frees reloc_vector without clearing the pointer, so the OOM error path
(goto out3) frees it a second time. Full details and reproduction
material are on bug #34573.

2026-08-27  Jinbao Chen  <zkd18cjb@mail.ustc.edu.cn>

	PR binutils/34573
	* syms.c (_bfd_stab_section_find_nearest_line): Set reloc_vector
	to NULL after freeing it, matching out2/out1, to avoid a double
	free via out3 on the out-of-memory path.

 	 VM address.  Do this in two passes: once to count how many

Verified locally: with the patch applied, the reproduction from #34573
no longer aborts (rc=0); the unconstrained control run is unchanged.

Thank you.

Comments

Alan Modra Aug. 27, 2026, 11 p.m. UTC | #1 
On Fri, Aug 28, 2026 at 01:33:55AM +0800, zkd18cjb@mail.ustc.edu.cn wrote:
> Hello binutils maintainers,
> 
> This is a robustness fix for a double free in
> _bfd_stab_section_find_nearest_line (bfd/syms.c): the normal path
> frees reloc_vector without clearing the pointer, so the OOM error path
> (goto out3) frees it a second time. Full details and reproduction
> material are on bug #34573.

Thanks for the bug report and patch.  I have applied it, along with
correcting the goto.
diff mbox series

Patch

--- a/bfd/syms.c
+++ b/bfd/syms.c
@@ -1130,6 +1130,7 @@ 
 	}
 
       free (reloc_vector);
+      reloc_vector = NULL;	/* Avoid a double free via out3 on OOM.  */
 
       /* First time through this function, build a table matching
 	 function VM addresses to stabs, then sort based on starting