Report
RL78 PLT symbol name construction trusts exact allocation size
dced0c30-5eb8-43f2-b58d-4cb7901f5c0e
In binutils' RL78 ELF linker backend, a synthetic symbol name is built by copying the original symbol name into a freshly allocated buffer and appending ".plt". The buffer size is computed as strlen(name)+5, which is just enough for the original name, suffix, and NUL terminator. This pattern is fragile and easy to get wrong in similar linker backends; if the allocation or suffix logic diverges, it becomes a heap overflow. In the audited snapshot the sizing appears exact, but the code is still an unsafe string-composition idiom worth flagging for future regression analysis.