Report
Unchecked strcpy/strcat after malloc in RL78 PLT symbol synthesis
5819b010-64d4-4b1b-8b3a-ffb33ab06a86
In the RL78 ELF backend, a synthesized symbol name is allocated with strlen(name)+5 and then built with strcpy/strcat before being passed to the linker. If the caller supplies a long symbol name, this size calculation is insufficient because it does not reserve space for the trailing NUL and relies on unsafe concatenation, creating a heap overflow path during relocation processing.