https://sourceware.org/bugzilla/show_bug.cgi?id=34443
Bug ID: 34443
Summary: ld: SEGV in bfd_putl64 (bfd/libbfd.c:989) during
relocation output — still reproducible at HEAD (cf.
bug 33456)
Product: binutils
Version: 2.47
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: 2722900221 at qq dot com
Target Milestone: ---
Created attachment 16867
--> https://sourceware.org/bugzilla/attachment.cgi?id=16867&action=edit
PoC
Summary
Linking a malformed ELF object with `--gc-sections --no-print-gc-sections -w`
triggers a NULL-derived-pointer write in `bfd_putl64` (`bfd/libbfd.c:989`,
`addr[7] = ...` at address `0x7`). The call chain is
`elf_x86_64_relocate_section` (`elf64-x86-64.c:4683`) →
`bfd_elf64_swap_reloca_out` (`elfcode.h:467`) → `_bfd_elf_append_rela` →
`bfd_putl64`. A malformed relocation yields a NULL/underflowed output
relocation buffer pointer that is then written through.
This is the same crash site as previously-reported bug 33456 (`bfd_putl64`). It
still reproduces at HEAD/2.47 — the fix appears incomplete.
Affected Version
- binutils 2.47 (release tarball, version date `20260726`) — reproduced.
- Originally triaged on dev snapshot `2.47.50.20260722` (commit `640a79623`).
Reproduction
Build (ASAN):
CC=gcc CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common' \
LDFLAGS='-fsanitize=address' \
./configure --disable-gdb --disable-gdbserver --disable-sim --disable-cet \
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu
MAKEINFO=true
make -j
Run:
export
ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1"
ld --gc-sections --no-print-gc-sections -w -o /dev/null bug_10.o
Error Log
==65121==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000007 (pc
0x5a9fd43aa00b bp 0x7ffd0a900180 sp 0x7ffd0a900180 T0)
The signal is caused by a WRITE memory access.
#0 bfd_putl64
/home/user/build/binutils-2.47/bfd/libbfd.c:989
#1 bfd_elf64_swap_reloca_out
/home/user/build/binutils-2.47/bfd/elfcode.h:467
#2 _bfd_elf_append_rela
/home/user/build/binutils-2.47/bfd/elflink.c:15625
#3 elf_x86_64_relocate_section
/home/user/build/binutils-2.47/bfd/elf64-x86-64.c:4683
#4 elf_link_input_bfd
/home/user/build/binutils-2.47/bfd/elflink.c:11926
#5 _bfd_elf_final_link
/home/user/build/binutils-2.47/bfd/elflink.c:13189
#6 ldwrite
/home/user/build/binutils-2.47/ld/ldwrite.c:548
SUMMARY: AddressSanitizer: SEGV /home/user/build/binutils-2.47/bfd/libbfd.c:989
in bfd_putl64
--
You are receiving this mail because:
You are on the CC list for the bug.
