From patchwork Thu Aug 27 17:33:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: zkd18cjb@mail.ustc.edu.cn X-Patchwork-Id: 142338 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 85AF24BA2E2B for ; Thu, 27 Aug 2026 17:34:44 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 85AF24BA2E2B Authentication-Results: sourceware.org; dkim=fail reason="signature verification failed" (1024-bit key, secure) header.d=mail.ustc.edu.cn header.i=@mail.ustc.edu.cn header.a=rsa-sha256 header.s=dkim header.b=RIpwBGQv X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from ustc.edu.cn (smtp.ustc.edu.cn [202.38.64.46]) by sourceware.org (Postfix) with ESMTP id 8D7A54BA901D for ; Thu, 27 Aug 2026 17:34:02 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 8D7A54BA901D Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=mail.ustc.edu.cn Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=mail.ustc.edu.cn ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 8D7A54BA901D Authentication-Results: sourceware.org; arc=none smtp.remote-ip=202.38.64.46 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787852049; cv=none; b=eIQiGZ1Y9XJ92QzJP+RrBpn34b9mLfhxfzKNUqNg5glGmwTGW8vSAD/W7phsd4UPzbXu4ZtpTmQIvp+egiII+kPekdM2nNe3HFCLmu+DwSHtmla8pW4oJWHFifWbwGF58kFYfY0Yxv52NE2Jf2kCeVHodtegz7XVuoY4IyYP3Nk= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1787852049; c=relaxed/simple; bh=DRRr1tlPlzMbWExcdoI9LaeMNMEbmnI47FPHuN5OiP0=; h=DKIM-Signature:Date:From:To:Subject:MIME-Version:Message-ID; b=IQVMmuXOw1C8mvLDc81fbAp5URE86dnSmMdwFdXueOv0B9WOXAZVZ61BVadW7vxp3wIeyNPGGhgd3mViXnzIPWyVhSOXTC7DhtTJjmhQxoU0w3pc5bCQ+tR0U5oegQEtomr6y/TFbn9E9JpsjjUbxE8OLEv+SIYnQItGcHd0BfM= ARC-Authentication-Results: i=1; sourceware.org; dkim=fail (1024-bit key, secure) header.d=mail.ustc.edu.cn header.i=@mail.ustc.edu.cn header.a=rsa-sha256 header.s=dkim header.b=RIpwBGQv reason="signature verification failed" DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 8D7A54BA901D DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mail.ustc.edu.cn; s=dkim; h=Received:Date:From:To:Subject: Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID; bh=CrX/umI+K6R0almfoG8mP1nhG1iQK/d8D7gvNcyxgg8=; b=RIpwBGQv+AorA 9e0nke5LGWiX3LS+ilNa4zSOJvwTMLvSwaLtc/QtlOrKEgxkaj90URRX9cPzvIaX On4n75WPo6VVwdCrBtUgE5Vt5CEXO01dSAqcWZ6C2N7BAH3+SX/MmWLOgtkhBWR2 Jlaq7QdTU6/RroxxwpUX9fpMUS5P+8= Received: from zkd18cjb$mail.ustc.edu.cn ( [154.211.161.136] ) by ajax-webmail-mailweb2024 (Coremail) ; Fri, 28 Aug 2026 01:33:55 +0800 (GMT+08:00) X-Originating-IP: [154.211.161.136] Date: Fri, 28 Aug 2026 01:33:55 +0800 (GMT+08:00) X-CM-HeaderCharset: UTF-8 From: zkd18cjb@mail.ustc.edu.cn To: binutils@sourceware.org Subject: Subject: [PATCH] bfd: avoid double free in _bfd_stab_section_find_nearest_line on the out-of-memory path X-Priority: 3 X-Mailer: Coremail Webmail Server Version 2024.3-cmXT6 build 20250609(354f7833) Copyright (c) 2002-2026 www.mailtech.cn ustccn MIME-Version: 1.0 Message-ID: <5b41acb2.997fa.1a044491757.Coremail.zkd18cjb@mail.ustc.edu.cn> X-Coremail-Locale: zh_CN X-CM-TRANSID: 3ZYKCgCHX7gEdZBqI5AGAA--.8237W X-CM-SenderInfo: p2ngimxfmeqzxdloh3xvwfhvlgxou0/1tbiAREMBGqPef9RiAABsj X-Coremail-Antispam: 1Ur529EdanIXcx71UUUUU7IcSsGvfJ3iIAIbVAYjsxI4VWxJw CS07vEb4IE77IF4wCS07vE1I0E4x80FVAKz4kxMIAIbVAFxVCaYxvI4VCIwcAKzIAtYxBI daVFxhVjvjDU= X-Spam-Status: No, score=2.1 required=5.0 tests=BAYES_00, DKIM_INVALID, DKIM_SIGNED, KAM_DMARC_STATUS, KAM_EDU_FROM, RCVD_IN_PBL, SPF_HELO_PASS, SPF_PASS, TXREP shortcircuit=no autolearn=no autolearn_force=no version=3.4.6 X-Spam-Level: ** X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patchwork=sourceware.org@sourceware.org Hello binutils maintainers, This is a robustness fix for a double free in _bfd_stab_section_find_nearest_line (bfd/syms.c): the normal path frees reloc_vector without clearing the pointer, so the OOM error path (goto out3) frees it a second time. Full details and reproduction material are on bug #34573. 2026-08-27 Jinbao Chen PR binutils/34573 * syms.c (_bfd_stab_section_find_nearest_line): Set reloc_vector to NULL after freeing it, matching out2/out1, to avoid a double free via out3 on the out-of-memory path. VM address. Do this in two passes: once to count how many Verified locally: with the patch applied, the reproduction from #34573 no longer aborts (rc=0); the unconstrained control run is unchanged. Thank you. --- a/bfd/syms.c +++ b/bfd/syms.c @@ -1130,6 +1130,7 @@ } free (reloc_vector); + reloc_vector = NULL; /* Avoid a double free via out3 on OOM. */ /* First time through this function, build a table matching function VM addresses to stabs, then sort based on starting