Report
Unchecked symbol-name copy in RL78 PLT stub builder
04c39dc5-a7e9-4fb4-98bb-aea44b687fc8
In binutils BFD's RL78 ELF backend, the linker constructs a synthesized symbol name for PLT entries by allocating strlen(name)+5 bytes and then copying the original symbol name with strcpy() before appending ".plt". The allocation assumes the source is a properly terminated, trustworthy C string and that the computed length matches the bytes copied. If an unexpected long or malformed name reaches this path, the synthesized name can overflow or corrupt heap metadata during linking of crafted objects.