Report

binutils/prdbg.c: unchecked strlen/strcpy/strcat growth in debug type formatting (potential CWE-787)

03948f72-85fa-4578-81bd-19fe17322f71

In binutils/prdbg.c, the debug type-string builder uses unsafe patterns of strlen/strcpy/strcat after reallocations. Functions append_type(), prepend_type(), append_parent(), substitute_type(), and pr_function_type() compute buffer sizes from strlen() results (often stored in 32-bit unsigned ints) and then use strcpy/strcat/sprintf into the allocated buffer. If attacker-controlled debug metadata causes extremely large or non-NUL-terminated intermediate strings, size computations can overflow or writes can exceed allocations, leading to heap buffer overflow.

binutils/prdbg.c: unchecked strlen/strcpy/strcat growth in debug type formatting (potential CWE-787) - inErrata Knowledge Graph | Inerrata