https://sourceware.org/bugzilla/show_bug.cgi?id=34448
Bug ID: 34448
Summary: ld: NULL-pointer deref in
_bfd_x86_elf_late_size_sections /
elf_x86_allocate_dynrelocs (bfd/elfxx-x86.c:337 / :553
/ :2334) via malformed dynamic relocs
Product: binutils
Version: 2.47
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: 2722900221 at qq dot com
Target Milestone: ---
Created attachment 16878
--> https://sourceware.org/bugzilla/attachment.cgi?id=16878&action=edit
PoC (bug_1)
Summary
Malformed input driving dynamic-relocation sizing causes NULL `htab`/`sreloc`
(or equivalent) dereferences in the x86 ELF size-sections path.
bug_1 and bug_4 are different lines of `elf_x86_allocate_dynrelocs`; bug_18 is
its caller `_bfd_x86_elf_late_size_sections`.
Likely one root cause (NULL section/sreloc during dynamic reloc allocation).
Affected Version
- binutils 2.47 (release tarball, version date `20260726`) — all three
reproduced.
- Originally triaged on dev snapshot `2.47.50.20260722` (commit `640a79623`).
Reproduction
Build (ASAN):
CC=gcc CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common' \
LDFLAGS='-fsanitize=address' \
./configure --disable-gdb --disable-gdbserver --disable-sim --disable-cet \
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu
MAKEINFO=true
make -j
Run:
export
ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1"
ld --gc-sections --no-print-gc-sections -w -o /dev/null bug_1.o # :337
ld --shared --gc-sections -o /dev/null bug_4.o # :553
ld --shared --gc-sections -o /dev/null bug_18.o # :2334
Error Log
bug_1 (:337):
==64986==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000070 (pc
0x5d6f41bda6e7 ...)
#0 elf_x86_allocate_dynrelocs
/home/user/build/binutils-2.47/bfd/elfxx-x86.c:337
#1 bfd_link_hash_traverse
/home/user/build/binutils-2.47/bfd/linker.c:693
#2 _bfd_x86_elf_late_size_sections
/home/user/build/binutils-2.47/bfd/elfxx-x86.c:2418
#3 bfd_elf_size_dynamic_sections
/home/user/build/binutils-2.47/bfd/elflink.c:7756
SUMMARY: AddressSanitizer: SEGV elfxx-x86.c:337 in elf_x86_allocate_dynrelocs
bug_4 (:553):
==65031==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000038 (pc
0x593562e028fc ...)
#0 elf_x86_allocate_dynrelocs
/home/user/build/binutils-2.47/bfd/elfxx-x86.c:553
SUMMARY: AddressSanitizer: SEGV elfxx-x86.c:553 in elf_x86_allocate_dynrelocs
bug_18 (:2334):
==65836==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000038 (pc
0x5736562a5cfe ...)
#0 _bfd_x86_elf_late_size_sections
/home/user/build/binutils-2.47/bfd/elfxx-x86.c:2334
#1 bfd_elf_size_dynamic_sections
/home/user/build/binutils-2.47/bfd/elflink.c:7756
#2 ldelf_before_allocation
/home/user/build/binutils-2.47/ld/ldelf.c:1840
SUMMARY: AddressSanitizer: SEGV elfxx-x86.c:2334 in
_bfd_x86_elf_late_size_sections
--
You are receiving this mail because:
You are on the CC list for the bug.
