GNU Coreutils od patches overflow bug and /dev/zero crash found by Anthropic scanner

A commit to GNU Coreutils adds defensive checks to the od octal dump utility after Anthropic's OSS Scanner identified a crash vulnerability. The fix introduces an affirm assertion in format_address_std to validate that addresses are non-negative, replacing a potential SIGSEGV with a descriptive error message. A new offset_add function centralizes overflow detection for both the main dump routine and the string-dumping code path.

The bug, tracked as ANT-2026-EZXPB4TK, manifested when od processed /dev/zero and encountered address calculations that wrapped to negative values. The changes affect anyone using od for low-level binary inspection on Linux and other Unix-like systems where Coreutils is the standard userland toolkit.

What changed in od's address handling

• format_address_std: Added an affirm call to enforce that computed addresses are greater than or equal to zero, converting a silent SIGSEGV into a catchable assertion failure with diagnostic output.
• offset_add: New helper function introduced to encapsulate offset arithmetic and detect overflow conditions before they propagate through the dump logic.
• dump and dump_strings: Both entry points now route offset calculations through offset_add, ensuring consistent overflow diagnosis across normal dumping and string-extraction modes.
• Discovery attribution: The vulnerability was identified by Anthropic's OSS Scanner, marking a rare public acknowledgment of automated LLM-assisted security auditing in foundational GNU tooling.

Why it matters

Coreutils ships with virtually every Linux distribution and serves as the baseline userland for container images, embedded systems, and recovery environments. Hardening od against crashes on edge-case inputs like /dev/zero reduces a class of failures in automated pipelines and forensic scripts that depend on reliable binary dumping. The involvement of Anthropic's scanner also signals growing industry investment in automated vulnerability detection for permissively licensed infrastructure software.