[Bug debugedit/28408] debugedit segfaults while changing binutils' build-id

["mark at klomp dot org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=28408

Mark Wielaard <mark at klomp dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-10-05
             Status|UNCONFIRMED                 |ASSIGNED
                 CC|                            |mark at klomp dot org
     Ever confirmed|0                           |1

--- Comment #1 from Mark Wielaard <mark at klomp dot org> ---
Thanks for the report and the reproducer.
Your analysis is correct.

The problem is summarized in this comment just before the problematic code:

  /* Slurp the relevant header bits and section contents and feed them
     into the hash function.  The only bits we ignore are the offset
     fields in ehdr and shdrs, since the semantically identical ELF file
     could be written differently if it doesn't change the phdr layout.
     We always use the GElf (i.e. Elf64) formats for the bits to hash
     since it is convenient.  It doesn't matter whether this is an Elf32
     or Elf64 object, only that we are consistent in what bits feed the
     hash so it comes out the same for the same file contents.  */

So we mangled the actual data structure, but then check it as if it hasn't been
flipped around anyway when checking for NOBITS. The fix is to use the original
data/shdr to check for NOBITS:

diff --git a/tools/debugedit.c b/tools/debugedit.c
index 668777a..3f1e830 100644
--- a/tools/debugedit.c
+++ b/tools/debugedit.c
@@ -3273,7 +3273,7 @@ handle_build_id (DSO *dso, Elf_Data *build_id,
          else
            sha1_process_bytes (x.d_buf, x.d_size, &sha1_ctx);

-         if (u.shdr.sh_type != SHT_NOBITS)
+         if (dso->shdr[i].sh_type != SHT_NOBITS)
            {
              Elf_Data *d = elf_getdata (dso->scn[i], NULL);
              if (d == NULL)

-- 
You are receiving this mail because:
You are on the CC list for the bug.