https://sourceware.org/bugzilla/show_bug.cgi?id=34446
Bug ID: 34446
Summary: ld: SEGV in _bfd_elf_eh_frame_section_offset
(bfd/elf-eh-frame.c:1840) via malformed .eh_frame with
`-r`
Product: binutils
Version: 2.47
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: 2722900221 at qq dot com
Target Milestone: ---
Created attachment 16874
--> https://sourceware.org/bugzilla/attachment.cgi?id=16874&action=edit
PoC(bug_9)
ld: SEGV in _bfd_elf_eh_frame_section_offset (bfd/elf-eh-frame.c:1840) via
malformed .eh_frame with `-r`
Summary
During relocatable link (`-r`), a malformed `.eh_frame` section causes a NULL
`cie_inf` (or equivalent) pointer to be dereferenced in
`_bfd_elf_eh_frame_section_offset` (`bfd/elf-eh-frame.c:1840`), crashing `ld`.
DoS-class NULL deref. This is the section-offset query path of the eh_frame
handler, distinct from the write path filed in bug 34445.
This issue may be an incomplete fix for bug 33478 and bug 33499.
Affected Version
- binutils 2.47 (release tarball, version date `20260726`) — reproduced.
- Originally triaged on dev snapshot `2.47.50.20260722` (commit `640a79623`).
Reproduction
Build (ASAN):
CC=gcc CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common' \
LDFLAGS='-fsanitize=address' \
./configure --disable-gdb --disable-gdbserver --disable-sim --disable-cet \
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu
MAKEINFO=true
make -j
Run:
export
ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1"
ld -r -o /dev/null bug_9.o
Error Log
==65106==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000a (pc
0x64d9935f0876 bp 0x7ffe184c69b0 sp 0x7ffe184c6990 T0)
The signal is caused by a READ memory access.
#0 _bfd_elf_eh_frame_section_offset
/home/user/build/binutils-2.47/bfd/elf-eh-frame.c:1840
#1 _bfd_elf_section_offset
/home/user/build/binutils-2.47/bfd/elf.c:13361
#2 elf_link_input_bfd
/home/user/build/binutils-2.47/bfd/elflink.c:11987
#3 _bfd_elf_final_link
/home/user/build/binutils-2.47/bfd/elflink.c:13189
#4 ldwrite
/home/user/build/binutils-2.47/ld/ldwrite.c:548
SUMMARY: AddressSanitizer: SEGV
/home/user/build/binutils-2.47/bfd/elf-eh-frame.c:1840 in
_bfd_elf_eh_frame_section_offset
--
You are receiving this mail because:
You are on the CC list for the bug.
