https://sourceware.org/bugzilla/show_bug.cgi?id=34843

            Bug ID: 34843
           Summary: GNU ld retags incompatible reserved section names and
                    emits malformed ET_REL output
           Product: binutils
           Version: 2.48 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: ld
          Assignee: unassigned at sourceware dot org
          Reporter: basavesh.shivakumar at wsu dot edu
  Target Milestone: ---

Created attachment 17163
  --> https://sourceware.org/bugzilla/attachment.cgi?id=17163&action=edit
repro

I'm reporting this bug on behalf of my team: Ananta Srikar Puranam, Emily West,
Dr. Swarn Priya, Dr. Peng Gao and Dr. Basavesh Ammanaghatta Shivakumar.

Summary
=======

GNU ld accepts incompatible reserved section name/type pairs under -r and its
common name-based output hook retags them without constructing the required
type-specific relationships, producing either SHT_RELA with size 8/entsize
24/link 0/info 0 or an extra SHT_SYMTAB linked to SHT_NULL; one-field controls
emit valid ELF.

Reproduction
============

1. Download and extract
`bfd-reserved-section-name-retag-invalid-output-reproducer.tar.gz`.
2. Run the following command with an ld.bfd or all-target `ld-new` binary that
   supports the emulation used by the reproducer:

       LD_BFD=/path/to/ld-new sh repro.sh

The archive contains the fixed input files, independent controls, helper
scripts needed by `repro.sh`, and their checksums. The script uses a temporary
directory and does not modify the source tree.

Observed result
===============

GNU ld accepts incompatible reserved section name/type pairs under -r and its
common name-based output hook retags them without constructing the required
type-specific relationships, producing either SHT_RELA with size 8/entsize
24/link 0/info 0 or an extra SHT_SYMTAB linked to SHT_NULL; one-field controls
emit valid ELF.

Expected result
===============

GNU ld should either produce the correct output or reject the input with a
normal diagnostic. It should not crash, hang, execute undefined behavior, read
outside an input-derived allocation, or produce the described malformed
output.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

Reply via email to