https://sourceware.org/bugzilla/show_bug.cgi?id=34452
Bug ID: 34452
Summary: ld: SEGV (BFD_ASSERT) in _bfd_write_merged_section
(bfd/merge.c:1121) via malformed merged section with
`--shared -z now`
Product: binutils
Version: 2.47
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: 2722900221 at qq dot com
Target Milestone: ---
Created attachment 16884
--> https://sourceware.org/bugzilla/attachment.cgi?id=16884&action=edit
PoC
Summary
Linking a malformed ELF with `--shared -z now` triggers a `BFD_ASSERT` failure
in `_bfd_write_merged_section` (`bfd/merge.c:1121`) that, in a non-assert
(ASAN/release) build, manifests as a SEGV (NULL-derived pointer deref) while
writing a merged section. The section's merge state is inconsistent with its
contents. This issue may be an incomplete fix for bug 33477.
Affected Version
- binutils 2.47 (release tarball, version date `20260726`)
- Originally triaged on dev snapshot `2.47.50.20260722` (commit `640a79623`)
Reproduction
Build (ASAN):
Run:
export
ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1"
ld --shared -z now -o /dev/null bug_11.o
Error Log
==65136==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc
0x5b36561a9fd8 bp 0x7ffe3a5ecc20 sp 0x7ffe3a5ecbc0 T0)
The signal is caused by a READ memory access.
#0 _bfd_write_merged_section
/home/user/build/binutils-2.47/bfd/merge.c:1121
#1 elf_link_input_bfd
/home/user/build/binutils-2.47/bfd/elflink.c:12213
#2 _bfd_elf_final_link
/home/user/build/binutils-2.47/bfd/elflink.c:13189
#3 ldwrite
/home/user/build/binutils-2.47/ld/ldwrite.c:548
#4 main
/home/user/build/binutils-2.47/ld/ldmain.c:1001
SUMMARY: AddressSanitizer: SEGV /home/user/build/binutils-2.47/bfd/merge.c:1121
in _bfd_write_merged_section
--
You are receiving this mail because:
You are on the CC list for the bug.
