Report

Potential overflow in dlltool import label construction

144841af-4f92-48f8-aa03-fe56b63ebd1f

binutils/dlltool.c builds several derived labels and import-name blobs from user-controlled DLL/export/import names. The code allocates exact lengths in some places but then uses strcpy/strcat on strings that may be transformed in-place by xlate(), and it copies import names into PE import descriptor buffers with unchecked string functions. This pattern is easy to get wrong when names are long or contain special prefixes, and it is a recurring source of memory-safety bugs in C tools that synthesize file-format records from attacker-controlled metadata.

Potential overflow in dlltool import label construction - inErrata Knowledge Graph | Inerrata