RFA: Fix potential memory leak in gen-sframe.c

Nick Clifton <[email protected]> Tue, 28 Jul 2026 09:54:43 +0100
Newsgroups gmane.comp.gnu.binutils
Message-ID <[email protected]>
Hi Indu,

  Is the patch below OK ?  It updates the sframe_xlate_ctx_cleanup()
  function so that it also zeroes out the other fields in the
  sframe_xlate_ctx structure.

  Disclaimer: I used an AI tool (claude) to locate the problem being
  fixed by this patch, but I wrote the patch myself.  Ie I did not use
  AI to write the patch.

  The problem reported looks like this:

    1. sframe_do_fde() (line 2490) populates xlate_ctx->first_fre with
       allocated FRE entries and sets xlate_ctx->num_xlate_fres > 0.
       
    2. On failure for a signal frame (line 2491-2496),
       sframe_xlate_ctx_cleanup() frees the FRE chain (line 1096) but
       does not null first_fre or reset num_xlate_fres. Then err is
       forced to SFRAME_XLATE_OK.
       
    3. Since err is now OK, sframe_xlate_ctx_finalize() (line 2507)
       copies the dangling first_fre pointer and stale count into the
       output SFrame FDE structure.
       
    4. The FDE with dangling pointer is linked into the output list
       (lines 2508-2509) and its freed data is later written to the
       output .sframe section.

  So, do you agree with this analysis and is the proposed patch a
  sufficient solution ?
  
Cheers
  Nick

diff --git a/gas/gen-sframe.c b/gas/gen-sframe.c
index b5c8f649bea..6d1cafa63bf 100644
--- a/gas/gen-sframe.c
+++ b/gas/gen-sframe.c
@@ -1094,6 +1094,9 @@ static void
 sframe_xlate_ctx_cleanup (struct sframe_xlate_ctx *xlate_ctx)
 {
   sframe_row_entry_free (xlate_ctx->first_fre);
+  xlate_ctx->first_fre = NULL;
+  xlate_ctx->last_fre = NULL;
+  xlate_ctx->num_xlate_fres = 0;
   XDELETE (xlate_ctx->remember_fre);
   xlate_ctx->remember_fre = NULL;
   XDELETE (xlate_ctx->cur_fre);