https://sourceware.org/bugzilla/show_bug.cgi?id=32642
Bug ID: 32642
Summary: ld SEGV (illegal read access) in
_bfd_elf_write_section_eh_frame
(bfd/elf-eh-frame.c:2234:29) with --gc-sections
--gc-keep-exported option
Product: binutils
Version: 2.43
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: swj22 at mails dot tsinghua.edu.cn
Target Milestone: ---
Created attachment 15917
--> https://sourceware.org/bugzilla/attachment.cgi?id=15917&action=edit
poc
**Description**
A segv can occur in ld (part of binutils 2.43) when using the --gc-sections
and --gc-keep-exported options with a specially crafted input file. This issue
leads to memory corruption (illegal memory read access) and crashes.
**Affected Version**
GNU ld (GNU Binutils) 2.43
**Steps to Reproduce**
Build binutils 2.43 with AddressSanitizer (e.g., CFLAGS="-g -fsanitize=address"
./configure && make -j).
Run the following command:
./binutils-2.43/bins/bin/ld --gc-sections --gc-keep-exported $poc
Observe the AddressSanitizer error indicating a segv.
./binutils-2.43/bins/bin/ld --gc-sections --gc-keep-exported /tmp/poc
./binutils-2.43/bins/bin/ld: warning: cannot find entry symbol _start;
defaulting to 0000000000401000
./binutils-2.43/bins/bin/ld: /tmp/poc: in function `reallocarray':
openbsd-reallocarray.c:(.text+0x16d): undefined reference to `__errno_location'
./binutils-2.43/bins/bin/ld: /tmp/poc: in function `__afl_setup_first':
openbsd-reallocarray.c:(.text+0x2a7): undefined reference to `getenv'
./binutils-2.43/bins/bin/ld: openbsd-reallocarray.c:(.text+0x2b8): undefined
reference to `atoi'
./binutils-2.43/bins/bin/ld: /tmp/poc: in function `__afl_forkserver':
openbsd-reallocarray.c:(.text+0x303): undefined reference to `write'
./binutils-2.43/bins/bin/ld: /tmp/poc: in function `__afl_fork_wait_loop':
openbsd-reallocarray.c:(.text+0x327): undefined reference to `read'
./binutils-2.43/bins/bin/ld: openbsd-reallocarray.c:(.text+0x336): undefined
reference to `fork'
./binutils-2.43/bins/bin/ld: openbsd-reallocarray.c:(.text+0x362): undefined
reference to `write'
./binutils-2.43/bins/bin/ld: openbsd-reallocarray.c:(.text+0x37c): undefined
reference to `waitpid'
./binutils-2.43/bins/bin/ld: openbsd-reallocarray.c:(.text+0x3a0): undefined
reference to `write'
./binutils-2.43/bins/bin/ld: /tmp/poc: in function `__afl_fork_resume':
openbsd-reallocarray.c:(.text+0x3b1): undefined reference to `close'
./binutils-2.43/bins/bin/ld: openbsd-reallocarray.c:(.text+0x3bd): undefined
reference to `close'
./binutils-2.43/bins/bin/ld: /tmp/poc: in function `__afl_die':
openbsd-reallocarray.c:(.text+0x492): undefined reference to `_exit'
./binutils-2.43/bins/bin/ld: /tmp/poc: in function `reallocarray':
openbsd-reallocarray.c:(.text+0x161): undefined reference to `realloc'
AddressSanitizer:DEADLYSIGNAL
=================================================================
==485892==ERROR: AddressSanitizer: SEGV on unknown address 0x00087fff8000 (pc
0x564fe3b3de6e bp 0x7ffc56de3df0 sp 0x7ffc56de3180 T0)
==485892==The signal is caused by a READ memory access.
#0 0x564fe3b3de6e in _bfd_elf_write_section_eh_frame
./binutils-2.43/bfd/elf-eh-frame.c:2234:29
#1 0x564fe3ae8114 in elf_link_input_bfd
./binutils-2.43/bfd/elflink.c:12142:12
#2 0x564fe3ad6f0d in bfd_elf_final_link
./binutils-2.43/bfd/elflink.c:13107:11
#3 0x564fe38cfd0e in ldwrite ./binutils-2.43/ld/ldwrite.c:550:8
#4 0x564fe38ca4e9 in main ./binutils-2.43/ld/./ldmain.c:556:3
#5 0x7f1c87b4a082 in __libc_start_main
/build/glibc-LcI20x/glibc-2.31/csu/../csu/libc-start.c:308:16
#6 0x564fe37a26bd in _start (./binutils-2.43/bins/bin/ld+0x15a6bd)
(BuildId: d9731e405748db264b62c84ded760ba4f068cb0a)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ./binutils-2.43/bfd/elf-eh-frame.c:2234:29 in
_bfd_elf_write_section_eh_frame
==485892==ABORTING
** Env **
Distributor ID: Ubuntu
Description: Ubuntu 20.04.6 LTS
Release: 20.04
Codename: focal
--
You are receiving this mail because:
You are on the CC list for the bug.
