Re: RFC: Fix for CVE-2026-19548

Hi Alan,

> The bug report says:
> "The vulnerability is triggered when LTO plugins are active
> (link_info.lto_plugin_active is true) and the input object has
> abfd->my_archive == NULL"
> 
> If my_archive is NULL the bfd isn't an archive member!

True - I suspect that this is a theoretical bug, rather than an exploitable one.

> How is it that add_archive_element is being called for something that
> isn't a member of an archive?  Do you have a testcase?

No - I was just responding to the CVE - which does not provide a testcase.
Cheers
   Nick