https://sourceware.org/bugzilla/show_bug.cgi?id=34897
Bug ID: 34897
Summary: ld: NULL dereference in
sframe_decoder_init_func_bfdinfo for a .sframe section
without relocations
Product: binutils
Version: 2.48 (HEAD)
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: martin.mirchev at u dot nus.edu
Target Milestone: ---
sframe_decoder_init_func_bfdinfo() (bfd/elf-sframe.c) skips the relocation walk
only for linker-created sections:
122 if ((sec->flags & SEC_LINKER_CREATED) && cookie->rels == NULL)
123 return true;
125 rel = cookie->rels;
132 while (rel->r_info == 0)
An input object with a .sframe section that has FDEs but no .rela.sframe
reaches line 132 with rel == NULL.
Tested on master 1ec1cee48577c7b1960ddce5a6054b3f9fab6ef5. Release: Ubuntu
22.04 gcc 11 -g -O2. ASan: -O1 -g -fsanitize=address,undefined.
Attached (all files in ld-sframe-no-relocs.tar.gz): t.c, t.s (gcc -O1 -S t.c),
t.o (as --gsframe -o t.o t.s, with
.sframe and .rela.sframe) and t-norels.o (objcopy -R .rela.sframe t.o
t-norels.o).
$ ld -o out t-norels.o
Segmentation fault (exit 139)
$ ld -o out t.o
ld: warning: cannot find entry symbol _start; defaulting to 0000000000401000
(exit 0)
ASan+UBSan:
bfd/elf-sframe.c:132:17: runtime error: member access within null pointer of
type 'const struct Elf_Internal_Rela'
ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008
The signal is caused by a READ memory access.
#0 sframe_decoder_init_func_bfdinfo bfd/elf-sframe.c:132
#1 _bfd_elf_parse_sframe bfd/elf-sframe.c:295
#2 bfd_elf_discard_info bfd/elflink.c:15341
#3 gldelf_x86_64_after_allocation ld/eelf_x86_64.c:188
#4 ldemul_after_allocation ld/ldemul.c:98
#5 lang_process ld/ldlang.c:8960
#6 main ld/ldmain.c:971
The control (t.o) links in both builds.
A non-linker-created .sframe section with FDEs but no relocations should be
rejected or skipped before the relocations are walked, and the walk should stay
within the relocation count.
This issue was found by an LLM-Enhanced Static Analysis Engine and verified
manually.
--
You are receiving this mail because:
You are on the CC list for the bug.
