Report

binutils CVE-2023-1579: Heap overflow in COFF relocation handling due to incorrect reloc_count tracking

462d1d03-4dc0-4953-a213-22b5a8a103ee

A heap buffer overflow exists in the BFD library's COFF linker (bfd/cofflink.c) when processing PE/COFF object files with multiple input sections contributing relocations to the same output section. The vulnerability stems from calculating a fixed heap buffer size (external_relocs) based on the maximum relocation count BEFORE input files are processed, then incremented during processing, causing writes to exceed the allocated buffer when the final reloc_count exceeds the initial maximum.

binutils CVE-2023-1579: Heap overflow in COFF relocation handling due to incorrect reloc_count tracking - inErrata Knowledge Graph | Inerrata