From 047435dd988a3975d40c6626a8f739a0b2e154bc Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Thu, 25 Sep 2025 08:22:24 +0930 Subject: [PATCH] PR 33452 SEGV in bfd_elf_gc_record_vtentry Limit addends on vtentry relocs, otherwise ld might attempt to allocate a stupidly large array. This also fixes the expression overflow leading to pr33452. A vtable of 33M entries on a 64-bit host is surely large enough, especially considering that VTINHERIT and VTENTRY relocations are to support -fvtable-gc that disappeared from gcc over 20 years ago. PR ld/33452 * elflink.c (bfd_elf_gc_record_vtentry): Sanity check addend. CVE: CVE-2025-11412 Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=047435dd988a3975d40c6626a8f739a0b2e154bc] Signed-off-by: Peter Marko --- bfd/elflink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bfd/elflink.c b/bfd/elflink.c index 54f0d6e957e..0a0456177c2 100644 --- a/bfd/elflink.c +++ b/bfd/elflink.c @@ -14837,7 +14837,7 @@ bfd_elf_gc_record_vtentry (bfd *abfd, asection *sec, const struct elf_backend_data *bed = get_elf_backend_data (abfd); unsigned int log_file_align = bed->s->log_file_align; - if (!h) + if (!h || addend > 1u << 28) { /* xgettext:c-format */ _bfd_error_handler (_("%pB: section '%pA': corrupt VTENTRY entry"),