Binutils hardens 18 ELF linkers against relaxation heap corruption

Harshit Kumar has posted a patch series for GNU Binutils that hardens eighteen ELF linker backends in BFD against heap corruption during code relaxation.

Linker relaxation often shrinks instructions and slides the rest of a section downward with memmove. If a relocation or section header supplies an out-of-range offset or a deletion count larger than the remaining bytes, the unsigned size calculation wraps to a value near SIZE_MAX. Unpatched linkers then overwrite heap memory or abort inside the allocator.

The series introduces a common bounds helper that rejects invalid deletion intervals and reports a clear bad-value error. All audited call sites across the affected targets either already checked the result or now propagate failure so the link fails cleanly instead of corrupting memory. The hardened backends include AVR, CR16, CRX, FT32, H8/300, IP2K, the MN10200/MN10300 pair, M32C, M68HC11, MIPS, MSP430, PRU, RISC-V, RL78, RX, SH, and V850. Regression tests cover several of the more exposed paths.

Related problems remain outside this change: some targets still rewrite opcodes before the deletion check, COFF SH has an equivalent pattern, and a few architectures (notably MicroBlaze playback paths, with similar patterns noted elsewhere) can still underflow on expansion or deferred replay. Those are flagged for follow-up work.

For anyone linking for the listed embedded and RISC-V targets, malformed or hostile objects that once risked linker heap damage should now fail with a diagnostic instead.