[PING] Two OOB read vulnerabilities in bfd/xcofflink.c — requesting CVE assignment

[Alan Modra]

On Fri, Feb 27, 2026 at 03:46:21PM +0800, The mist·CJM wrote:
> I recently reported two separate heap-buffer-overflow (OOB read)
> vulnerabilities in bfd/xcofflink.c to security@sourceware.org,
> with detailed analyses and PoCs attached:

I haven't seen that email.  Is there a security@sourceware.org
mailing list?  Note that binutils/SECURITY.txt specifies two other
mailing lists for security related bugs, and CVE assignment.

> 
> 1.OOB read at xcofflink.c:1919 (xcoff_link_add_symbols,
>    csects[] out-of-bounds access)
> 
> 
> 2. OOB read at xcofflink.c:2282 (xcoff_link_add_symbols, r_symndx
>    out-of-bounds access)

Please verify that this fixes your out-of-bounds accesses.

	* xcofflink.c (xcoff_link_add_symbols): Properly bounds check
	XTY_LD x_scnlen index.  Sanity check r_symndx before using it
	to index sym hashes.

diff --git a/bfd/xcofflink.c b/bfd/xcofflink.c
index fde21c9f958..1781182fa6a 100644
--- a/bfd/xcofflink.c
+++ b/bfd/xcofflink.c
@@ -1908,12 +1908,9 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
 	     follow its appropriate XTY_SD symbol.  The .set pseudo op can
 	     cause the XTY_LD to not follow the XTY_SD symbol. */
 	  {
-	    bool bad;
-
-	    bad = false;
-	    if (aux.x_csect.x_scnlen.u64
-		>= (size_t) (esym - (bfd_byte *) obj_coff_external_syms (abfd)))
-	      bad = true;
+	    bool bad = (aux.x_csect.x_scnlen.u64
+			>= ((esym - (bfd_byte *) obj_coff_external_syms (abfd))
+			    / symesz));
 	    if (! bad)
 	      {
 		section = xcoff_data (abfd)->csects[aux.x_csect.x_scnlen.u64];
@@ -2279,6 +2276,7 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
 		 functions imported from dynamic objects.  */
 	      if (info->output_bfd->xvec == abfd->xvec
 		  && *rel_csect != bfd_und_section_ptr
+		  && (unsigned long) rel->r_symndx < obj_raw_syment_count (abfd)
 		  && obj_xcoff_sym_hashes (abfd)[rel->r_symndx] != NULL)
 		{
 		  struct xcoff_link_hash_entry *h;


-- 
Alan Modra