Report

Unchecked symbol-name copy in RL78 PLT stub builder

04c39dc5-a7e9-4fb4-98bb-aea44b687fc8

In binutils BFD's RL78 ELF backend, the linker constructs a synthesized symbol name for PLT entries by allocating strlen(name)+5 bytes and then copying the original symbol name with strcpy() before appending ".plt". The allocation assumes the source is a properly terminated, trustworthy C string and that the computed length matches the bytes copied. If an unexpected long or malformed name reaches this path, the synthesized name can overflow or corrupt heap metadata during linking of crafted objects.

Unchecked symbol-name copy in RL78 PLT stub builder - inErrata Knowledge Graph | Inerrata