Bug 25018 - readelf crash on 32bits (at least i386 and armhf)
Summary: readelf crash on 32bits (at least i386 and armhf)
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.33
: P2 normal
Target Milestone: 2.33
Assignee: Alan Modra
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-09-19 07:42 UTC by Gianfranco
Modified: 2019-09-25 03:17 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments
example of failing file (755.82 KB, application/x-sharedlib)
2019-09-19 07:42 UTC, Gianfranco
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Gianfranco 2019-09-19 07:42:01 UTC
Created attachment 11996 [details]
example of failing file

I already reported to Ubuntu
https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1844119

This is a regression started after binutils_2.32.51.20190821-1
and before 2.32.51.20190905-0

so this is the changelog of changes in bfd
+2019-09-05  Alan Modra  <amodra@gmail.com>
+
+	* elf64-ppc.c (xlate_pcrel_opt): Handle prefix loads and stores
+	in second instruction.
+	(ppc64_elf_relocate_section): Likewise.
+
+2019-09-05  Alan Modra  <amodra@gmail.com>
+
+	PR 24955
+	* libbfd-in.h (bfd_strdup): New inline function.
+	* archive.c (_bfd_get_elt_at_filepos): Use bfd_strdup.  Close
+	bfd on error.
+	* elfcode.h (_bfd_elf_bfd_from_remote_memory): Use bfd_strdup.
+	* opncls.c (bfd_fopen): Use bfd_strdup.  Close fd and stream
+	on error.
+	(bfd_openstreamr): Use bfd_strdup.
+	(bfd_openr_iovec, bfd_openw, bfd_create): Likewise.
+	* plugin.c (try_load_plugin): Use bfd_malloc.
+	* libbfd.h: Regenerate.
+
+2019-09-02  Alan Modra  <amodra@gmail.com>
+
+	PR 11983
+	* dwarf2.c (_bfd_dwarf2_slurp_debug_info): Free debug_filename
+	on success.  Tidy.
+	(read_alt_indirect_string): Likewise.
+	(read_alt_indirect_ref): Likewise.
+
+2019-08-31  Jim Wilson  <jimw@sifive.com>
+
+	PR 23825
+	* elfnn-riscv.c (riscv_elf_create_dynamic_sections): Add SEC_LOAD,
+	SEC_DATA, and SEC_HAS_CONTENTS to .tdata.dyn section.
+
+2019-08-30  Jim Wilson  <jimw@sifive.com>
+
+	* elfnn-riscv.c (riscv_elf_relocate_section): For unresolvable reloc
+	error, call bfd_set_error, set ret to FALSE, and goto out label.
+
+2019-08-30  H.J. Lu  <hongjiu.lu@intel.com>
+
+	PR ld/24951
+	* archive.c (_bfd_get_elt_at_filepos): Copy BFD_COMPRESS,
+	BFD_DECOMPRESS and BFD_COMPRESS_GABI flags for thin archive.
+
+2019-08-29  Alan Modra  <amodra@gmail.com>
+
+	PR 24697
+	* elf32-ppc.c (ppc_elf_check_relocs): Call bad_shared_reloc
+	when !bfd_link_executable for R_PPC_EMB_SDA2I16 and
+	R_PPC_EMB_SDA2REL.  Don't call bad_shared_reloc for any other
+	reloc.
+
+2019-08-29  Alan Modra  <amodra@gmail.com>
+
+	* elf64-ppc.c (xlate_pcrel_opt): Add poff parameter.  Allow offset
+	on second insn, return it in poff.
+	(ppc64_elf_relocate_section): Add offset to paddi addend for
+	PCREL_OPT.
+
+2019-08-28  Jim Wilson  <jimw@sifive.com>
+
+	* elfnn-riscv.c (_bfd_riscv_relax_lui): Add check to exclude abs
+	section when setting max_alignment.  Update comment.
+	(_bfd_riscv_relax_pc): Likewise.
+
+2019-08-29  Alan Modra  <amodra@gmail.com>
+
+	PR 24891
+	* bfd.c (struct bfd): Add no_element_cache.
+	* archive.c (_bfd_get_elt_at_filepos): Don't add element to
+	archive cache when no_element_cache.
+	(bfd_generic_archive_p): Set no_element_cache when opening first
+	element to check format.  Close first element too.
+	(do_slurp_bsd_armap): Don't zero ardata->cache here.
+	* bfd-in2.h: Regenerate.
+
+2019-08-24  Alan Modra  <amodra@gmail.com>
+
+	* elf64-ppc.c (ppc64_elf_edit_toc): Exclude undefined weak
+	symbols from GOT optimisation.
+
+2019-08-23  Stafford Horne  <shorne@gmail.com>
+
+	* elf32-or1k.c (or1k_elf_finish_dynamic_symbol): Use correct value for
+	PLT GOT entries.
+
+2019-08-23  Nick Clifton  <nickc@redhat.com>
+
+	PR 24456
+	* elf.c (bfd_section_from_shdr): Issue an informative warning
+	message and continue processing other sections after encountering
+	a reloc section for a section which already has other relocs
+	associated with it.
+
+2019-08-23  Alan Modra  <amodra@gmail.com>
+
+	PR 24933
+	* elfxx-x86.c (_bfd_x86_elf_get_synthetic_symtab): Don't exit
+	on error without freeing plts[] contents.
+
+2019-08-22  Dennis Zhang  <dennis.zhang@arm.com>
+
+	* cpu-arm.c: New entries for Cortex-M35P, Cortex-A77, Cortex-A76AE.
+
+2019-08-22  Nick Clifton  <nickc@redhat.com>
+
+	PR 24922
+	* pei-x86_64.c (pex64_xdata_print_uwd_codes): Add checks before
+	reading data from extra records.
+
+2019-08-22  Tamar Christina  <tamar.christina@arm.com>
+
+	PR ld/24601
+	* elfnn-aarch64.c (aarch64_relocate): Handle weak TLS and undefined TLS.
+	Also Pass input_bfd to _bfd_aarch64_elf_resolve_relocation.
+	* elfxx-aarch64.c (_bfd_aarch64_elf_resolve_relocation): Use it.
+	* elfxx-aarch64.h (_bfd_aarch64_elf_resolve_relocation): Emit warning
+	for weak TLS.
+
+2019-08-22  Alan Modra  <amodra@gmail.com>
+
+	* elf32-arm.c (cmse_scan): Don't use ARM_GET_SYM_CMSE_SPCL,
+	instead recognize CMSE_PREFIX in symbol name.
+	(elf32_arm_gc_mark_extra_sections): Likewise.
+	(elf32_arm_filter_cmse_symbols): Don't test ARM_GET_SYM_CMSE_SPCL.
+	(elf32_arm_swap_symbol_in): Don't invoke ARM_SET_SYM_CMSE_SPCL.

and the full diff between good and bad
http://launchpadlibrarian.net/440335350/binutils_2.32.51.20190821-1ubuntu1_2.32.51.20190905-0ubuntu1.diff.gz

This is the stacktrace



    <65c00> DW_AT_external : 1
    <65c00> DW_AT_name : (indirect string, offset: 0x1d277): _M_get_allocator
    <65c04> DW_AT_decl_file : 2
    <65c05> DW_AT_decl_line : 290
    <65c07> DW_AT_decl_column : 7
    <65c08> DW_AT_linkage_name: (indirect string, offset: 0xdb15): _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE16_M_get_allocatorEv

Program received signal SIGSEGV, Segmentation fault.
0x56596128 in read_leb128 (data=0x87a81712 <error: Cannot access memory at address 0x87a81712>, length_return=0xffffd014, sign=0, end=0xf7dbecef "") at ../../binutils/dwarf.c:336
336 ../../binutils/dwarf.c: No such file or directory.
(gdb) bt full
#0 0x56596128 in read_leb128 (data=0x87a81712 <error: Cannot access memory at address 0x87a81712>, length_return=0xffffd014, sign=0, end=0xf7dbecef "") at ../../binutils/dwarf.c:336
        result = 0
        num_read = 0
        shift = 0
        byte = 0 '\000'
#1 0x56599e50 in read_uleb128 (end=0xf7dbecef "", length_return=<optimized out>, data=0x87a81711 <error: Cannot access memory at address 0x87a81711>) at ../../binutils/dwarf.c:2005
No locals.
#2 get_type_signedness (start=start@entry=0xf7cd1010 "\266X\006", data=0x87a81711 <error: Cannot access memory at address 0x87a81711>, end=end@entry=0xf7dbecef "", pointer_size=4, offset_size=4,
    dwarf_version=4, is_signed=0xffffd190, is_nested=1) at ../../binutils/dwarf.c:2005
        abbrev_number = <optimized out>
        bytes_read = 0
        entry = <optimized out>
        attr = <optimized out>
#3 0x56599f50 in get_type_signedness (start=start@entry=0xf7cd1010 "\266X\006", data=0xf7ce1238 "", end=end@entry=0xf7dbecef "", pointer_size=4, offset_size=4, dwarf_version=4, is_signed=0xffffd190,
    is_nested=0) at ../../binutils/dwarf.c:2045
        uvalue = <optimized out>
        abbrev_number = <optimized out>
        bytes_read = 1
        entry = <optimized out>
        attr = 0x56640530
#4 0x5659b968 in read_and_display_attr_value (attribute=attribute@entry=73, form=form@entry=19, implicit_const=-1, start=0xf7cd1010 "\266X\006", data=<optimized out>, end=0xf7dbecef "",
    cu_offset=415930, pointer_size=4, offset_size=4, dwarf_version=<optimized out>, debug_info_p=0x0, do_loc=<optimized out>, section=0x56617880 <debug_displays+192>, this_set=0x0,
    delimiter=<optimized out>, level=<optimized out>) at ../../binutils/dwarf.c:2732
        is_signed = 0
        uvalue = 66082
        block_start = <optimized out>
        orig_data = 0xf7d36c1c "\"\002\001"
        bytes_read = 4160392480
        __PRETTY_FUNCTION__ = "read_and_display_attr_value"
#5 0x5659efb4 in read_and_display_attr (level=<optimized out>, this_set=0x0, section=0x56617880 <debug_displays+192>, do_loc=0, debug_info_p=0x0, dwarf_version=4, offset_size=<optimized out>,
    pointer_size=4, cu_offset=415930, end=0xf7dbecef "", data=0xf7d36c1c "\"\002\001", start=0xf7cd1010 "\266X\006", implicit_const=<optimized out>, form=19, attribute=<optimized out>)
    at ../../binutils/dwarf.c:3119
No locals.
#6 process_debug_info (section=0x56617880 <debug_displays+192>, file=<optimized out>, abbrev_sec=abbrev, do_loc=0, do_types=<optimized out>) at ../../binutils/dwarf.c:3646
        bytes_read = 1
        die_offset = <optimized out>
        do_printing = 1
        abbrev_number = <optimized out>
        entry = 0x5663e9b0
        attr = <optimized out>
        debug_info_p = <optimized out>
        hdrptr = <optimized out>
        sec_off = <optimized out>
        offset_size = 4
        signature_low = 0
        tags = 0xf7d36c1c "\"\002\001"
        signature_high = 0
        this_set = 0x0
        abbrev_base = <optimized out>
        abbrev_size = <optimized out>
        initial_length_size = <optimized out>
        compunit = {cu_length = <optimized out>, cu_version = 4, cu_abbrev_offset = <optimized out>, cu_pointer_size = <optimized out>, cu_unit_type = <optimized out>}
        level = <optimized out>
        last_level = 4
        saved_level = -1
        cu_offset = 415930
        type_offset = <optimized out>
        start = <optimized out>
        end = 0xf7dbecef ""
        section_begin = <optimized out>
        unit = 1
        num_units = <optimized out>
        __PRETTY_FUNCTION__ = "process_debug_info"
#7 0x5658b464 in display_debug_section (filedata=<optimized out>, section=0x566202b0, shndx=30) at ../../binutils/readelf.c:14291
        secondary = <optimized out>
        id = info
        display = 0x56617880 <debug_displays+192>
        sec = 0x56617880 <debug_displays+192>
        length = <optimized out>
        i = 3
        name = <optimized out>
        print_name = <optimized out>
        result = 1
        name = <optimized out>
        print_name = <optimized out>
        length = <optimized out>
        result = <optimized out>
        i = <optimized out>
        id = <optimized out>
        display = <optimized out>
        sec = <optimized out>
        secondary = <optimized out>
#8 process_section_contents (filedata=<optimized out>) at ../../binutils/readelf.c:14382
        dump = 4 '\004'
        section = 0x566202b0
        i = 30
        res = 1
#9 0x5658c915 in process_section_contents (filedata=0x5661e1d0) at ../../binutils/readelf.c:19999
        section = <optimized out>
        i = <optimized out>
        res = 1
        section = <optimized out>
        i = <optimized out>
        res = <optimized out>
        dump = <optimized out>
#10 process_object (filedata=<optimized out>) at ../../binutils/readelf.c:19999
        have_separate_files = 0
        i = <optimized out>
        res = 1
        have_separate_files = <optimized out>
        i = <optimized out>
        res = <optimized out>
        __PRETTY_FUNCTION__ = "process_object"
        d = <optimized out>
        g = <optimized out>
        next = <optimized out>
#11 process_object (filedata=<optimized out>) at ../../binutils/readelf.c:19915
        have_separate_files = <optimized out>
        i = <optimized out>
        __PRETTY_FUNCTION__ = "process_object"
        d = <optimized out>
        g = <optimized out>
        next = <optimized out>
#12 0x5655a2a5 in process_file (file_name=0xffffdae6 "libjsoncpp.so.1.8.1") at ../../binutils/readelf.c:20429
        filedata = 0x5661e1d0
        statbuf = {st_dev = 66306, __pad1 = 1, __st_ino = 2393533, st_mode = 33188, st_nlink = 1, st_uid = 0, st_gid = 0, st_rdev = 0, __pad2 = 39680, st_size = 2316140, st_blksize = 4096, st_blocks = 4528, st_atim = {tv_sec = 1568630072, tv_nsec = 756767631}, st_mtim = {tv_sec = 1568630063, tv_nsec = 792762404}, st_ctim = {tv_sec = 1568630063, tv_nsec = 792762404}, st_ino = 2393533}
        armag = "\177ELF\001\001\001"
        ret = 1
        filedata = <optimized out>
        statbuf = <optimized out>
        armag = <optimized out>
        ret = <optimized out>
#13 main (argc=<optimized out>, argv=<optimized out>) at ../../binutils/readelf.c:20488
        err = <optimized out>
Comment 1 Sourceware Commits 2019-09-22 23:36:31 UTC
The master branch has been updated by Alan Modra <amodra@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b3fe587ed2c78d46132bd33e14f42449d410354b

commit b3fe587ed2c78d46132bd33e14f42449d410354b
Author: Alan Modra <amodra@gmail.com>
Date:   Mon Sep 23 08:53:07 2019 +0930

    PR25018, readelf crash on 32bits
    
    Pointer comparisons after adding an offset just don't work to catch
    overflow when the offset is a larger type than the pointer.
    
    	PR 25018
    	* dwarf.c (get_type_signedness): Delete ineffective pointer
    	comparison check.  Properly range check uvalue offset on
    	recursive call.
    	(read_and_display_attr_value): Range check uvalue offset before
    	calling get_type_signedness.
Comment 2 Alan Modra 2019-09-22 23:54:03 UTC
Fixed.
Comment 3 Sourceware Commits 2019-09-25 02:19:06 UTC
The binutils-2_33-branch branch has been updated by Alan Modra <amodra@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=a11b3493ca2d5aabdc218197b92026098d7e2f57

commit a11b3493ca2d5aabdc218197b92026098d7e2f57
Author: Alan Modra <amodra@gmail.com>
Date:   Mon Sep 23 08:53:07 2019 +0930

    PR25018, readelf crash on 32bits
    
    Pointer comparisons after adding an offset just don't work to catch
    overflow when the offset is a larger type than the pointer.
    
    	PR 25018
    	* dwarf.c (get_type_signedness): Delete ineffective pointer
    	comparison check.  Properly range check uvalue offset on
    	recursive call.
    	(read_and_display_attr_value): Range check uvalue offset before
    	calling get_type_signedness.
    
    (cherry picked from commit b3fe587ed2c78d46132bd33e14f42449d410354b)