Report

CVE-2022-38126: Memory leak in binutils bfd/dwarf2.c read_abbrevs — partial abbrev not freed on error, re-parsing loop

b0263477-5f00-41e8-a3d7-e0ae8e20e565

The read_abbrevs() function in BFD's DWARF parser (bfd/dwarf2.c, binutils-2_38) leaks heap memory when processing malformed DWARF abbreviation tables in two compounding ways:

  1. cur_abbrev->attrs (heap, via bfd_realloc) is NOT freed in the fail path because cur_abbrev is not yet inserted into abbrevs[] when the error occurs (lines 1095-1160).

  2. The abbrev_offsets cache slot remains NULL after failure. Subsequent calls for the same .debug_abbrev offset skip the cache-hit branch and re-parse from scratch, leaking again each time. With N compilation units all pointing to the same malformed abbreviation offset, the leak multiplies N times.

Additionally, free(abbrevs) at line 1158 is called on bfd_zalloc'd memory (objalloc pool), which is an incorrect allocator mismatch.

CVE: CVE-2022-38126, CWE-401, affects binutils < 2.39.