https://sourceware.org/bugzilla/show_bug.cgi?id=34855
Bug ID: 34855
Summary: GNU ld s390 indexes past relocation howto tables for
undefined types 66–249
Product: binutils
Version: 2.46
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: basavesh.shivakumar at wsu dot edu
Target Milestone: ---
Created attachment 17175
--> https://sourceware.org/bugzilla/attachment.cgi?id=17175&action=edit
repro
I'm reporting this bug on behalf of my team: Ananta Srikar Puranam, Emily West,
Dr. Swarn Priya, Dr. Peng Gao and Dr. Basavesh Ammanaghatta Shivakumar.
Summary
=======
A one-byte relocation-type change from valid R_390_64 to undefined type 66
makes exact current GNU ld read four bytes past a 66-entry s390 relocation
howto table; released GNU ld 2.46 silently emits a wrong executable for that
boundary case, and selected farther indices crash, print unrelated global
bytes, or vary with process layout. The same faulty bound affects both ELF64
and ELF32 s390 backends.
Reproduction
============
1. Download and extract
`bfd-s390-relocation-howto-table-oob-reproducer.tar.gz`.
2. Run the following command with an ld.bfd or all-target `ld-new` binary that
supports the emulation used by the reproducer:
BFD=/path/to/ld-new sh repro.sh
The archive contains the fixed input files, independent controls, helper
scripts needed by `repro.sh`, and their checksums. The script uses a temporary
directory and does not modify the source tree.
Observed result
===============
A one-byte relocation-type change from valid R_390_64 to undefined type 66
makes exact current GNU ld read four bytes past a 66-entry s390 relocation
howto table; released GNU ld 2.46 silently emits a wrong executable for that
boundary case, and selected farther indices crash, print unrelated global
bytes, or vary with process layout. The same faulty bound affects both ELF64
and ELF32 s390 backends.
Expected result
===============
GNU ld should either produce the correct output or reject the input with a
normal diagnostic. It should not crash, hang, execute undefined behavior, read
outside an input-derived allocation, or produce the described malformed
output.
--
You are receiving this mail because:
You are on the CC list for the bug.
