https://sourceware.org/bugzilla/show_bug.cgi?id=34451
Bug ID: 34451
Summary: ld: SEGV in bfd_elf_set_group_contents
(bfd/elf.c:3952) via malformed SHT_GROUP section with
`-r`
Product: binutils
Version: 2.47
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: 2722900221 at qq dot com
Target Milestone: ---
Created attachment 16883
--> https://sourceware.org/bugzilla/attachment.cgi?id=16883&action=edit
PoC
Summary
During relocatable link (`-r`), `bfd_elf_set_group_contents` (`bfd/elf.c:3952`)
dereferences a NULL group-related pointer while finalizing `SHT_GROUP` section
contents (called from `_bfd_elf_final_link` → `bfd_map_over_sections`). A
malformed group section (e.g. bad section/element linkage) leaves a NULL
pointer that is dereferenced. This issue is similar to bug 23141 and bug 25699,
possibly due to incomplete fixes.
Affected Version
- binutils 2.47 (release tarball, version date `20260726`)
- Originally triaged on dev snapshot `2.47.50.20260722` (commit `640a79623`)
Reproduction
Build (ASAN):
CC=gcc CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common' \
LDFLAGS='-fsanitize=address' \
./configure --disable-gdb --disable-gdbserver --disable-sim --disable-cet \
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu
MAKEINFO=true
make -j
Run:
export
ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1"
ld -r -o /dev/null bug_7.o
Error Log
==65076==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000c0 (pc
0x56dc9fd356f1 bp 0x7ffc33d293e0 sp 0x7ffc33d29360 T0)
The signal is caused by a READ memory access.
#0 bfd_elf_set_group_contents /home/user/build/binutils-2.47/bfd/elf.c:3952
#1 bfd_map_over_sections
/home/user/build/binutils-2.47/bfd/section.c:1369
#2 _bfd_elf_final_link
/home/user/build/binutils-2.47/bfd/elflink.c:13820
#3 ldwrite
/home/user/build/binutils-2.47/ld/ldwrite.c:548
#4 main
/home/user/build/binutils-2.47/ld/ldmain.c:1001
SUMMARY: AddressSanitizer: SEGV /home/user/build/binutils-2.47/bfd/elf.c:3952
in bfd_elf_set_group_contents
--
You are receiving this mail because:
You are on the CC list for the bug.
