[Bug binutils/26795] New: double free in process_archive in binutils/elfedit.c

[msebor at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26795

            Bug ID: 26795
           Summary: double free in process_archive in binutils/elfedit.c
           Product: binutils
           Version: 2.36 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: msebor at gmail dot com
  Target Milestone: ---

Building the latest Binutils with an experimental version of GCC 11 triggers
the following warning:

src/binutils-gdb/binutils/elfedit.c: In function ‘process_archive’:
/src/binutils-gdb/binutils/elfedit.c:690:7: warning: ‘free’ called with a freed
pointer [-Wuse-after-free=]
  690 |       free (qualified_name);
      |       ^~~~~~~~~~~~~~~~~~~~~
/src/binutils-gdb/binutils/elfedit.c:658:11: note: freed by ‘free’ here
  658 |           free (qualified_name);
      |           ^~~~~~~~~~~~~~~~~~~~~
/src/binutils-gdb/binutils/elfedit.c:618:24: note: allocated by
‘make_qualified_name’ here
  618 |       qualified_name = make_qualified_name (&arch, &nested_arch, name);
      |                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

As far as I can tell from the code in the function the warning looks justified:

   656            fclose (member_file);
   657            free (member_file_name);
   658            free (qualified_name);
   659          }
   660        else if (is_thin_archive)
   661          {
   ...
   680          }
   681        else
   682          {
   ...
   688          }
   689  
   690        free (qualified_name);
   691      }

-- 
You are receiving this mail because:
You are on the CC list for the bug.