https://sourceware.org/bugzilla/show_bug.cgi?id=34447
Bug ID: 34447
Summary: ld: NULL-pointer deref in elf_link_add_object_symbols
(bfd/elflink.c:5527 / :6080) via malformed symbol /
version info
Product: binutils
Version: 2.47
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: 2722900221 at qq dot com
Target Milestone: ---
Created attachment 16875
--> https://sourceware.org/bugzilla/attachment.cgi?id=16875&action=edit
PoC(bug_5)
Summary
Malformed symbol and/or version tables cause NULL-pointer dereferences during
symbol addition in `elf_link_add_object_symbols`.
bug_6 and bug_16 land on the same line in the 2.47 release (the findings table
listed :5528 vs :5527 from the dev snapshot — same site). Likely one root cause
around unchecked symbol/alias/section pointers during versioned-symbol
addition.
This issue may be an incomplete fix for bug 33476.
Affected Version
- binutils 2.47 (release tarball, version date `20260726`) — all three
reproduced.
- Originally triaged on dev snapshot `2.47.50.20260722` (commit `640a79623`).
Reproduction
Build (ASAN):
CC=gcc CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common' \
LDFLAGS='-fsanitize=address' \
./configure --disable-gdb --disable-gdbserver --disable-sim --disable-cet \
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu
MAKEINFO=true
make -j
Run:
export
ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1"
ld --shared --gc-sections -o /dev/null bug_5.o # :6080
ld --shared -o /dev/null bug_6.o # :5527
ld --shared -o /dev/null bug_16.o # :5527
Error Log
bug_5 (:6080):
==65046==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000078 (pc
0x58fcf955b522 ...)
#0 elf_link_add_object_symbols
/home/user/build/binutils-2.47/bfd/elflink.c:6080
#1 bfd_elf_link_add_symbols
/home/user/build/binutils-2.47/bfd/elflink.c:6447
#2 load_symbols
/home/user/build/binutils-2.47/ld/ldlang.c:3343
#3 open_input_bfds
/home/user/build/binutils-2.47/ld/ldlang.c:3837
SUMMARY: AddressSanitizer: SEGV elflink.c:6080 in elf_link_add_object_symbols
bug_6 / bug_16 (:5527):
... BFD (GNU Binutils) 2.47.20260726 assertion fail
/home/user/build/binutils-2.47/bfd/elflink.c:5522
AddressSanitizer:DEADLYSIGNAL
==65061==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000004a ...
#0 elf_link_add_object_symbols
/home/user/build/binutils-2.47/bfd/elflink.c:5527
#1 bfd_elf_link_add_symbols
/home/user/build/binutils-2.47/bfd/elflink.c:6447
#2 load_symbols
/home/user/build/binutils-2.47/ld/ldlang.c:3343
SUMMARY: AddressSanitizer: SEGV elflink.c:5527 in elf_link_add_object_symbols
--
You are receiving this mail because:
You are on the CC list for the bug.
