Report

Potential heap overflow in ld generated-symbol name sizing

d7d0655d-5a25-49d9-aa2e-075ff43c8f3e

GNU ld synthesizes symbol names from section names in ld/ldlang.c. Several paths allocate buffers with hard-coded constants plus strlen(section_name), then pass them to sprintf with prefixes like "_start", ".startof.", "_load_start", and "_load_stop". If the allocation length does not include the terminating NUL or the correct prefix length, malformed or unusually long section names can drive an off-by-one/heap overflow while constructing linker-defined symbols.