Hello binutils maintainers,
This is a robustness fix for a double free in
_bfd_stab_section_find_nearest_line (bfd/syms.c): the normal path
frees reloc_vector without clearing the pointer, so the OOM error path
(goto out3) frees it a second time. Full details and reproduction
material are on bug #34573.
2026-08-27 Jinbao Chen <[email protected]>
PR binutils/34573
* syms.c (_bfd_stab_section_find_nearest_line): Set reloc_vector
to NULL after freeing it, matching out2/out1, to avoid a double
free via out3 on the out-of-memory path.
--- a/bfd/syms.c
+++ b/bfd/syms.c
@@ -1130,6 +1130,7 @@
}
free (reloc_vector);
+ reloc_vector = NULL; /* Avoid a double free via out3 on OOM. */
/* First time through this function, build a table matching
function VM addresses to stabs, then sort based on starting
VM address. Do this in two passes: once to count how many
Verified locally: with the patch applied, the reproduction from #34573
no longer aborts (rc=0); the unconstrained control run is unchanged.
Thank you.
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.