Arbitrary code execution in objdump -g
Summary
The article analyzes an arbitrary code execution vulnerability in objdump -g caused by a missing bounds check in FR30 relocation handling within binutils. It walks through the exploit chain, from an OOB heap write to a complex sequence leveraging BFD internals, and describes the upstream fix that adds bounds checks. It serves as a detailed security research write-up with practical PoC details and mitigations.