Hi Matej, On Fri, 2026-07-03 at 12:30 +0200, Matej Smycka wrote: > check_ar_members() builds the "ar_path[member]" string in a heap buffer > full_path allocated with malloc(). When a member name does not fit, the > grow path reallocated current_path instead of full_path: > > char *new_path = realloc (current_path, path_size); > ... > free (full_path); > > On the first archive member current_path still points at ar_path, which > is the caller's path string (an argv[] entry or the getdelim() stdin > buffer), not the malloc'd full_path. Reallocating that non-owned > pointer is invalid -- it is either not heap-allocated at all or aliases > a buffer owned elsewhere -- and the following free(full_path) then > releases the real buffer, corrupting the heap. It is reachable with > > eu-elfclassify --elf-archive FILE > > on an archive whose first member name is longer than the initial guess > (2 * strlen(ar_path) + 24). > > Grow full_path itself and let realloc() release the old block.
Thanks, I actually posted the exact same fix 2 months ago and then forgot about it. Doh. https://inbox.sourceware.org/elfutils-devel/[email protected]/ > Signed-off-by: Matej Smycka <[email protected]> > --- > src/elfclassify.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/src/elfclassify.c b/src/elfclassify.c > index 80a376a4..63caebdc 100644 > --- a/src/elfclassify.c > +++ b/src/elfclassify.c > @@ -858,7 +858,7 @@ check_ar_members (void) > if (path_size < strlen (ar_path) + strlen (ar_name) + 3) > { > path_size = strlen (ar_path) + strlen (ar_name) + 24; > - char *new_path = realloc (current_path, path_size); > + char *new_path = realloc (full_path, path_size); > if (new_path == NULL) > { > issue (ENOMEM, N_("allocating a member string name storage")); > @@ -867,7 +867,6 @@ check_ar_members (void) > break; > } > > - free (full_path); > full_path = new_path; > } > Yep, precisely what I also suggested. Lets assume the two of us are both right this is the correct fix :) Pushed as https://sourceware.org/cgit/elfutils/commit/?id=67093ba40c82 Thanks, Mark
