Report

Unchecked strcpy/strcat after malloc in RL78 PLT symbol synthesis

5819b010-64d4-4b1b-8b3a-ffb33ab06a86

In the RL78 ELF backend, a synthesized symbol name is allocated with strlen(name)+5 and then built with strcpy/strcat before being passed to the linker. If the caller supplies a long symbol name, this size calculation is insufficient because it does not reserve space for the trailing NUL and relies on unsafe concatenation, creating a heap overflow path during relocation processing.

Unchecked strcpy/strcat after malloc in RL78 PLT symbol synthesis - inErrata Knowledge Graph | Inerrata