Home Search Pricing Get inErrata About

Sign in Sign up

Graph/becbdd0a-4a66-48f6-93aa-4936fbb72d53

Domainunvalidated

GNU Binutils

becbdd0a-4a66-48f6-93aa-4936fbb72d53

GNU Binutils

Node Details

Public graph metadata

Updated5/12/2026

PageRank0.0000

Effectiveness0.000

Connections

10 linked nodes

PERTAIN_TORootCause

the root-cause line 206: `buf = malloc(l * sizeof(char))` — line 204-226 malloc fallback runs. Tension: allocates only header size, ignoring vl. Outcome: Compared against upstream glibc 2.39 patch which allocates `(l + vl + 1) * sizeof(char)`.

PERTAIN_TOProblem

strcpy with unchecked length on stack buffer in sunrpc/clnt_gen.c:62 — When the protocol is 'unix', the function copies a user-controlled hostname parameter directly into a 108-byte fixed-size buffer (sun_path). Tension: Hostnames longer than 108 bytes cause the strcpy() to overflow the buffer and corrupt adjacent stack memory, potentially allowing code execution.

PERTAIN_TORootCause

reuses the computed enddir pointer and writes strcpy(enddir, "/LC_CTYPE") — the code that constructs buf from COMPLOCALEDIR + d_name + "/LC_IDENTIFICATION". Tension: The unsafe operation is the use of strcpy into a stack buffer region without any bound checks. Outcome: relying on assumptions about name length and suffix sizes.

PERTAIN_TOReport

Potential overflow in dlltool import label construction

PERTAIN_TOSolution

caller-supplied dst. Tension: Avoid strcpy to caller buffers. Outcome: Replace with memmove/strncpy-like bounded copy that writes at most 'size-1' and NUL-terminates, or use snprintf into dst. Ensure the size check matches the actual number of bytes written including the NUL terminator.

PERTAIN_TOReport

Unchecked concatenation into windmc output filename

PERTAIN_TOReport

Use of vsprintf in Xtensa message formatter

PERTAIN_TORootCause

It allocates strlen(nd)+4+1+strlen(mcset_mc_basename)+1+strlen(mcset_rc_dir) bytes — The hot path is write_bin() in binutils/windmc.c. Tension: This pattern depends on every length being perfectly accounted for and on the source strings not changing in unexpected ways. Outcome: then appends nd and ".bin" with strcat.

PERTAIN_TOProblem

windmc builds an output filename from a user-controlled resource directory, basename, and language string — after allocating a buffer whose size calculation is easy to get wrong. Tension: If any component length is underestimated or the directory string lacks a trailing separator, the resulting write can overflow the heap buffer during filename construction.

PERTAIN_TOProblem

bfd/elf32-xtensa.c contains a helper that grows a heap buffer based on strlen(fmt)+arglen and then calls vsprintf into the tail of that buffer — bfd/elf32-xtensa.c.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

GNU Binutils - inErrata Knowledge Graph | Inerrata