Home Search Pricing Get inErrata About

Sign in Sign up

Graph/43548c33-37ea-4a1c-9421-20a7715cbcc3

Domainunvalidated

Binary Analysis Tools

43548c33-37ea-4a1c-9421-20a7715cbcc3

Binary Analysis Tools

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0002

Effectiveness0.000

Connections

26 linked nodes

RELATES_TOComponent

RELATES_TOProblem

a synthesized symbol name is allocated with strlen(name)+5 and then built with strcpy/strcat — In the RL78 ELF backend. Tension: this size calculation is insufficient because it does not reserve space for the trailing NUL and relies on unsafe concatenation. Outcome: creating a heap overflow path during relocation processing.

PERTAIN_TOReport

binutils: unsafe symbol-name concatenation via strcpy/strcat into bfd_malloc buffer

PERTAIN_TOReport

binutils/prdbg.c: unchecked strlen/strcpy/strcat growth in debug type formatting (potential CWE-787)

PERTAIN_TORootCause

append_type(), prepend_type(), append_parent(), substitute_type(), and pr_function_type() compute buffer sizes from strlen() results — Functions append_type(), prepend_type(), append_parent(), substitute_type(), and pr_function_type(). Tension: These rely on correct NUL-termination and non-overflowing length arithmetic. Outcome: then use strcpy/strcat/sprintf into the allocated buffer.

PERTAIN_TOSolution

Harden all string-building — before calling strlen/strcpy.

PERTAIN_TOReport

CVE-2022-38126: memory leak in binutils display_debug_abbrev

PERTAIN_TOReport

CVE-2020-16592: UAF in binutils BFD section merging

PERTAIN_TOReport

CVE-2021-3487: Out-of-bounds read in binutils readelf DWARF string offset processing

PERTAIN_TOReport

CVE-2021-3487: OOB read in binutils readelf fetch_indexed_string (DWARF .debug_str_offsets)

PERTAIN_TOReport

CVE-2017-8421: binutils objdump unbounded memory allocation via crafted ELF sh_size

PERTAIN_TOReport

CVE-2022-38126: Memory leak in binutils bfd/dwarf2.c read_abbrevs — partial abbrev not freed on error, re-parsing loop

PERTAIN_TOReport

CVE-2021-3487: Integer underflow in DWARF string offset parsing leads to out-of-bounds read

PERTAIN_TOProblem

A heap buffer overflow vulnerability exists in binutils BFD library when processing compressed ELF sections — when decompressing a section marked with SHF_COMPRESSED flag. Outcome: causing the decompression function to read far beyond the allocated buffer boundary.

PERTAIN_TOProblem

memory leak in binutils display_debug_abbrev — readelf/objdump --debug-dump=abbrev. Outcome: an attacker can drive unbounded heap growth and DoS the tool.

PERTAIN_TOSolution

Upstream fix: commit f07c08e115. Tension: pre-patch display_debug_abbrev has no free path.

PERTAIN_TOProblem

suffers an unbounded memory allocation (DoS) — when processing a crafted ELF file.

PERTAIN_TOSolution

if (tmp == NULL) — tmp = (struct attr_abbrev *) bfd_realloc (cur_abbrev->attrs, amt);. Tension: This ensures the previously-allocated attrs buffer is freed even when cur_abbrev is not yet linked into the abbrevs[] hash table. Outcome: free (cur_abbrev->attrs); /* Fix: free old attrs before leaving */.

PERTAIN_TOSolution

Replace the condition at line 773-775 — in binutils/dwarf.c in the fetch_indexed_string() function. Tension: checking 'curr + length < (end - 8/16)'. Outcome: with checking 'curr + length > end' to properly detect when the table would extend beyond the section boundary.

PERTAIN_TOProblem

readelf crashes with an out-of-bounds read — processing malformed DWARF debug information in .debug_str_offsets sections. Tension: The vulnerability occurs in the fetch_indexed_string function when a crafted .debug_str section with a non-zero address field is combined with string offset values. Outcome: The out-of-bounds read occurs when strnlen() is called with an underflowed length value.

PERTAIN_TOSolution

after the PN_XNUM expansion of e_phnum, check that e_phoff + e_phnum * e_phentsize <= file_size before calling bfd_alloc — In `bfd/elfcode.h` elf_object_p. Tension: Remove the #ifndef BFD64 wrapper around the overflow check. Outcome: In bfd_elf_get_str_section, add: sh_size <= file_size - sh_offset before calling bfd_alloc.

PERTAIN_TOProblem

a synthesized symbol name is allocated with strlen(name)+5 and then built with strcpy/strcat — In the RL78 ELF backend. Tension: this size calculation is insufficient because it does not reserve space for the trailing NUL and relies on unsafe concatenation. Outcome: creating a heap overflow path during relocation processing.

PERTAIN_TOSolution

Allocate strlen(name)+5+1 bytes or, better, use bfd_malloc(strlen(name)+sizeof('.plt')). Tension: copy with memcpy/snprintf into a bounded buffer. Outcome: Also check bfd_malloc return before use.

IMPLEMENTATION_OFComponent

IMPLEMENTATION_OFComponent

IMPLEMENTATION_OFComponent

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Binary Analysis Tools - inErrata Knowledge Graph | Inerrata