https://sourceware.org/bugzilla/show_bug.cgi?id=34956
Bug ID: 34956
Summary: readelf: abort() in display_elf_relocation_at
(readelf.c:21092) on crafted GOT section metadata
Product: binutils
Version: 2.48 (HEAD)
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: binutils
Assignee: unassigned at sourceware dot org
Reporter: zc2012rdfz at 163 dot com
Target Milestone: ---
## Summary
`readelf -a` aborts on a crafted ELF64 object whose GOT-related relocation
metadata makes `display_elf_relocation_at()` take its
"should never happen" `default: abort()` branch. The input is accepted as
a valid-enough ELF; the abort is input-reachable, violating binutils'
own diagnostic-error conventions.
## Affected version
- binutils master `9db3b515...` (re-verified 2026-11-03; first observed on
`f747b0cd`, 2026-10-29).
- Build: `../configure --disable-gdb --disable-gold --disable-ld --disable-gas
--disable-werror CC=clang CFLAGS="-g -O1 -fsanitize=address"`; `make
all-binutils`
## PoC
Attached (`binutils_abort`, 31,184 bytes — an ELF64 shared-object-shaped
file; key ingredients: section header table with a symtab whose link field
points at index 2, plus GOT contents referencing relocation offsets whose
recorded `r_type` is outside the reader's expected enum set).
## Reproduction
```
$ readelf -a poc.so
(readelf: Warning: [11]: Link field (2) should index a symtab section.)
... symbol table dump ...
Program received signal SIGABRT
#5 display_elf_relocation_at (offset=0, g=0) at binutils/readelf.c:21092
#6 process_got_section_contents binutils/readelf.c:21281
#7 process_object binutils/readelf.c:24613
```
gdb backtrace attached (`binutils_abort.txt`).
## Root cause
`process_got_section_contents()` (readelf.c:21281) calls
`display_elf_relocation_at()` for GOT entries; the function iterates the
internally built `all_relocations_root[]` table and switches on
`r_type`. Crafted inputs populate that table with entries whose `r_type`
is not one of `reltype_rel/relr/...`, reaching:
```c
switch (all_relocations_root[i].r_type) {
default:
abort (); /* readelf.c:21092 */
```
The invariant assumed there (every recorded relocation type is a known
display kind) does not hold for hand-crafted section combinations, so
malformed input reaches `abort()` instead of a diagnostic (CWE-617,
input-driven crash / DoS in batch ELF analysis pipelines).
## Impact
Tools that run readelf over untrusted objects (malware triage, build farms,
package analyzers) crash on this input. Not memory corruption; a robust
`bfd_fatal`/warning path would match readelf conventions elsewhere.
## Reporter
Chi Zhang — Institute of Software, Chinese Academy of Sciences
Email: [email protected] · GitHub: @HappyBigBadWolf
Found by coverage-guided fuzzing (ASan build) on 2026-10-30 during a
48-hour campaign; re-verified on master `9db3b515` on 2026-11-03 (same
line). Public Bugzilla per project practice; no embargo requested.
--
You are receiving this mail because:
You are on the CC list for the bug.
