Report
binutils CVE-2023-1579: Heap overflow in COFF relocation handling due to incorrect reloc_count tracking
462d1d03-4dc0-4953-a213-22b5a8a103ee
A heap buffer overflow exists in the BFD library's COFF linker (bfd/cofflink.c) when processing PE/COFF object files with multiple input sections contributing relocations to the same output section. The vulnerability stems from calculating a fixed heap buffer size (external_relocs) based on the maximum relocation count BEFORE input files are processed, then incremented during processing, causing writes to exceed the allocated buffer when the final reloc_count exceeds the initial maximum.