https://sourceware.org/bugzilla/show_bug.cgi?id=34450
Bug ID: 34450
Summary: ld: SEGV in elf_orphan_compatible (ld/ldelf.c:2092)
during orphan section placement with `-r`
Product: binutils
Version: 2.47
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: 2722900221 at qq dot com
Target Milestone: ---
Created attachment 16882
--> https://sourceware.org/bugzilla/attachment.cgi?id=16882&action=edit
PoC
Summary
During relocatable link (`-r`), placing an orphan section dereferences a NULL
pointer in `elf_orphan_compatible` (`ld/ldelf.c:2092`, called from
`ldelf_place_orphan`). A malformed input section that becomes an orphan has no
compatible output section, and the comparison routine dereferences a NULL
section pointer. This issue may be an incomplete fix for bug 32647.
Affected Version
- binutils 2.47 (release tarball, version date `20260726`)
- Originally triaged on dev snapshot `2.47.50.20260722` (commit `640a79623`).
Reproduction
Build (ASAN):
CC=gcc CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common' \
LDFLAGS='-fsanitize=address' \
./configure --disable-gdb --disable-gdbserver --disable-sim --disable-cet \
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu
MAKEINFO=true
make -j
Run:
export
ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1"
ld -r -o /dev/null bug_2.o
Error Log
==65001==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000058 (pc
0x59545d4b3edb bp 0x7ffd2939edf0 sp 0x7ffd2939ed70 T0)
The signal is caused by a READ memory access.
#0 elf_orphan_compatible /home/user/build/binutils-2.47/ld/ldelf.c:2092
#1 ldelf_place_orphan /home/user/build/binutils-2.47/ld/ldelf.c:2259
#2 ldemul_place_orphan /home/user/build/binutils-2.47/ld/ldemul.c:152
#3 ldlang_place_orphan /home/user/build/binutils-2.47/ld/ldlang.c:7815
#4 lang_place_orphans /home/user/build/binutils-2.47/ld/ldlang.c:7871
SUMMARY: AddressSanitizer: SEGV /home/user/build/binutils-2.47/ld/ldelf.c:2092
in elf_orphan_compatible
--
You are receiving this mail because:
You are on the CC list for the bug.
