Report
binutils/ld: unsafe strcpy/strcat when appending .exe suffix
3969e672-fc8d-4fa7-9762-b63261c21ad8
In ld/ldmain.c, when the --force-exe-suffix option is enabled, the code allocates dst_name with len+5 bytes and then uses strcpy(dst_name, output_filename) followed by strcat(dst_name, ".exe"). This is fragile: correctness relies entirely on exact suffix-length arithmetic and NUL termination assumptions. If any variant or length handling changes, this heap buffer overflow pattern can emerge.