[PATCH v2] readelf: Update dynamic tag processing and validate section info

[H.J. Lu]

On Wed, Jul 1, 2026 at 2:37 PM H.J. Lu <hjl.tools@gmail.com> wrote:
>
> Count DT_RELR relocations using dynamic tags when section header isn't
> used.  Ignore section sh_offset and sh_size if they are larger than file
> size.
>
> One side effect is that we now display
>
> readelf: Warning: Ignore the out of range sh_offset value of
> 2199023261148 for section 17
> readelf: Warning: Ignore the out of range sh_size value of 13 for
> section 17 with sh_offset value of 2199023261148
> ...
>   [17] .fini             PROGBITS        00000000000015dc 000000
> 000000 00  AX  0   0  4
> ...
>
> instead of
>
> ...
>   [17] .fini             PROGBITS        00000000000015dc 200000015dc
> 00000d 00  AX  0   0  4
> ...
>
> and segfault.
>
> binutils/
>
> PR binutils/34326
> PR binutils/34339
> * readelf.c (update_all_relocations): Skip if nentries == 0.
> (validate_section_info): New.
> (get_32bit_section_headers): Call validate_section_info.
> (get_64bit_section_headers): Likewise.
> (process_relocs): Call count_relr_relocations if needed.  Check
> invalid invalid DT_RELENT and DT_RELAENT dynamic tags.
> (process_got_section_contents): Skip if all_relocations_count
> == 0.
>
> ld/
> PR binutils/34339
> * testsuite/ld-x86-64/binutils.exp: Run PR binutils/34339 tests.
> * testsuite/ld-x86-64/got-2.s: New file.
> * testsuite/ld-x86-64/libgot-2.rd: Likewise.
>

Here is the v2 patch.   Changes are:

1. Combine 2 readelf dump entries into one.


-- 
H.J.
---
Count DT_RELR relocations using dynamic tags when section header isn't
used.  Ignore section sh_offset and sh_size if they are larger than file
size.

One side effect is that we now display

readelf: Warning: Ignore the out of range sh_offset value of
2199023261148 for section 17
readelf: Warning: Ignore the out of range sh_size value of 13 for
section 17 with sh_offset value of 2199023261148
...
  [17] .fini             PROGBITS        00000000000015dc 000000
000000 00  AX  0   0  4
...

instead of

...
  [17] .fini             PROGBITS        00000000000015dc 200000015dc
00000d 00  AX  0   0  4
...

and segfault.

binutils/

PR binutils/34326
PR binutils/34339
* readelf.c (update_all_relocations): Skip if nentries == 0.
(validate_section_info): New.
(get_32bit_section_headers): Call validate_section_info.
(get_64bit_section_headers): Likewise.
(process_relocs): Call count_relr_relocations for relocations
from dynamic tags.  Skip if values in DT_RELENT/DT_RELAENT
are larger than values in DT_RELSZ/DT_RELASZ.
(process_got_section_contents): Skip if all_relocations_count
== 0.

ld/
PR binutils/34339
* testsuite/ld-x86-64/binutils.exp: Run PR binutils/34339 tests.
* testsuite/ld-x86-64/got-2.s: New file.
* testsuite/ld-x86-64/libgot-2.rd: Likewise.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: v2-0001-readelf-Update-dynamic-tag-processing-and-validat.patch
Type: text/x-patch
Size: 10778 bytes
Desc: not available
URL: <https://sourceware.org/pipermail/binutils/attachments/20260702/98119bee/attachment.bin>