Bug 34446 - ld: SEGV in _bfd_elf_eh_frame_section_offset (bfd/elf-eh-frame.c:1840) via malformed .eh_frame with `-r`
Summary: ld: SEGV in _bfd_elf_eh_frame_section_offset (bfd/elf-eh-frame.c:1840) via ma...
Status: UNCONFIRMED
Alias: None
Product: binutils
Classification: Unclassified
Component: ld (show other bugs)
Version: 2.47
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-07-28 02:17 UTC by LingMaple
Modified: 2026-07-28 02:17 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed:
Project(s) to access:
ssh public key:

Attachments
PoC(bug_9) (1.48 KB, application/x-object)
2026-07-28 02:17 UTC, LingMaple 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description LingMaple 2026-07-28 02:17:13 UTC 
Created attachment 16874 [details]
PoC(bug_9)

ld: SEGV in _bfd_elf_eh_frame_section_offset (bfd/elf-eh-frame.c:1840) via malformed .eh_frame with `-r`

Summary

During relocatable link (`-r`), a malformed `.eh_frame` section causes a NULL `cie_inf` (or equivalent) pointer to be dereferenced in `_bfd_elf_eh_frame_section_offset` (`bfd/elf-eh-frame.c:1840`), crashing `ld`. DoS-class NULL deref. This is the section-offset query path of the eh_frame handler, distinct from the write path filed in bug 34445.
This issue may be an incomplete fix for bug 33478 and bug 33499.

Affected Version

- binutils 2.47 (release tarball, version date `20260726`) — reproduced.
- Originally triaged on dev snapshot `2.47.50.20260722` (commit `640a79623`).

Reproduction

Build (ASAN):
CC=gcc CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common' \
LDFLAGS='-fsanitize=address' \
./configure --disable-gdb --disable-gdbserver --disable-sim --disable-cet \
            --disable-werror --disable-nls --enable-targets=x86_64-linux-gnu MAKEINFO=true
make -j

Run:
export ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1"
ld -r -o /dev/null bug_9.o


Error Log

==65106==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000a (pc 0x64d9935f0876 bp 0x7ffe184c69b0 sp 0x7ffe184c6990 T0)
The signal is caused by a READ memory access.
    #0 _bfd_elf_eh_frame_section_offset /home/user/build/binutils-2.47/bfd/elf-eh-frame.c:1840
    #1 _bfd_elf_section_offset           /home/user/build/binutils-2.47/bfd/elf.c:13361
    #2 elf_link_input_bfd                /home/user/build/binutils-2.47/bfd/elflink.c:11987
    #3 _bfd_elf_final_link               /home/user/build/binutils-2.47/bfd/elflink.c:13189
    #4 ldwrite                           /home/user/build/binutils-2.47/ld/ldwrite.c:548
SUMMARY: AddressSanitizer: SEGV /home/user/build/binutils-2.47/bfd/elf-eh-frame.c:1840 in _bfd_elf_eh_frame_section_offset