https://sourceware.org/bugzilla/show_bug.cgi?id=32641
Bug ID: 32641
Summary: ld SEGV (illegal read access) in
_bfd_x86_elf_check_relocs (bfd/elfxx-x86.c:980:19)
with -w option
Product: binutils
Version: 2.43
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: swj22 at mails dot tsinghua.edu.cn
Target Milestone: ---
Created attachment 15916
--> https://sourceware.org/bugzilla/attachment.cgi?id=15916&action=edit
poc
**Description**
A segv can occur in ld (part of binutils 2.43) when using the -w option with a
specially crafted input file. This issue leads to memory corruption (illegal
memory read access) and crashes.
**Affected Version**
GNU ld (GNU Binutils) 2.43
**Steps to Reproduce**
Build binutils 2.43 with AddressSanitizer (e.g., CFLAGS="-g -fsanitize=address"
./configure && make -j).
Run the following command:
./binutils-2.43/bins/bin/ld -w $poc
Observe the AddressSanitizer error indicating a segv.
./binutils-2.43/bins/bin/ld -w /tmp/poc
./binutils-2.43/bins/bin/ld: warning: /tmp/poc has a section extending past end
of file
./binutils-2.43/bins/bin/ld: /tmp/poc: invalid string offset 4278190371 >= 414
for section `.strtab'
AddressSanitizer:DEADLYSIGNAL
=================================================================
==485464==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc
0x55d3ba862329 bp 0x7ffc026c6a00 sp 0x7ffc026c6640 T0)
==485464==The signal is caused by a READ memory access.
==485464==Hint: address points to the zero page.
#0 0x55d3ba862329 in _bfd_x86_elf_check_relocs
./binutils-2.43/bfd/elfxx-x86.c:980:19
#1 0x55d3ba92bf35 in _bfd_elf_link_iterate_on_relocs
./binutils-2.43/bfd/elflink.c:4256:9
#2 0x55d3ba92c60d in _bfd_elf_link_check_relocs
./binutils-2.43/bfd/elflink.c:4277:12
#3 0x55d3ba8614ad in _bfd_x86_elf_link_check_relocs
./binutils-2.43/bfd/elfxx-x86.c:920:10
#4 0x55d3ba7fcfb1 in bfd_link_check_relocs
./binutils-2.43/bfd/linker.c:3371:10
#5 0x55d3ba72cda0 in lang_check_relocs ./binutils-2.43/ld/ldlang.c:8071:7
#6 0x55d3ba726795 in lang_process ./binutils-2.43/ld/ldlang.c:8383:3
#7 0x55d3ba75034c in main ./binutils-2.43/ld/./ldmain.c:529:3
#8 0x7f6764258082 in __libc_start_main
/build/glibc-LcI20x/glibc-2.31/csu/../csu/libc-start.c:308:16
#9 0x55d3ba6286bd in _start (./binutils-2.43/bins/bin/ld+0x15a6bd)
(BuildId: d9731e405748db264b62c84ded760ba4f068cb0a)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ./binutils-2.43/bfd/elfxx-x86.c:980:19 in
_bfd_x86_elf_check_relocs
==485464==ABORTING
** Env **
Distributor ID: Ubuntu
Description: Ubuntu 20.04.6 LTS
Release: 20.04
Codename: focal
--
You are receiving this mail because:
You are on the CC list for the bug.
