The demangle_template function in cplus-dem.c in GNU libiberty as distributed in GNU Binutils 2.31.1 contains an integer overflow vulnerability (for \Create an array for saving the template argument values\) that can trigger a heap-based buffer overflow as demonstrated by nm.