From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 22A1B3858024; Fri, 1 Oct 2021 16:33:31 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 22A1B3858024 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1633106011; bh=EIMR0Sd8dLofWVhmZ/8kOutjjF48IXzQEHjqkRObiiI=; h=From:To:Subject:Date:From; b=JzgOIQCEKzNv2CKCTHx24YLQG46Wez7OeUkEmTmIfCCydaQQP4XdozOplPUxs44Xh Y1Qt4VNHbwR/6JGk6et4eg/LH8BZwH54Esl5PXXsOp6GTde7v8RYLXwKggWND9Tj2R SO/UNJRi4uGS/3w99znrH4f4eVLfORJftcbJLPUk= From: "alexey.brodkin at gmail dot com" To: debugedit@sourceware.org Subject: [Bug debugedit/28408] New: debugedit segfaults while changing binutils' build-id Date: Fri, 01 Oct 2021 16:33:30 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: debugedit X-Bugzilla-Component: debugedit X-Bugzilla-Version: unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: alexey.brodkin at gmail dot com X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at sourceware dot org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter cc target_milestone attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: debugedit@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: debugedit development mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Oct 2021 16:33:31 -0000 https://sourceware.org/bugzilla/show_bug.cgi?id=3D28408 Bug ID: 28408 Summary: debugedit segfaults while changing binutils' build-id Product: debugedit Version: unspecified Status: UNCONFIRMED Severity: normal Priority: P2 Component: debugedit Assignee: unassigned at sourceware dot org Reporter: alexey.brodkin at gmail dot com CC: debugedit at sourceware dot org Target Milestone: --- Created attachment 13694 --> https://sourceware.org/bugzilla/attachment.cgi?id=3D13694&action=3Ded= it Cross-compiled m68k library Initially seen on cross-compilation of Binutils in Debian and then=20 reported here https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D995195. In a nutshell "debugedit" segfaults on attempt to run the following command= on x86_64 host against a binary built for a big-endian architecture in this example it's "libbfd-2.37-system.so" (attached) cross-compiled for m68k: ------------------------->8----------------------- $ debugedit --build-id --build-id-seed=3Dx libbfd-2.37-system.so Segmentation fault ------------------------->8----------------------- That's what we with GDB: ------------------------->8----------------------- $ gdb --args ./debugedit --build-id --build-id-seed=3Dx libbfd-2.37-system.= so (gdb) r Starting program: .../debugedit/debugedit --build-id --build-id-seed=3Dx libbfd-2.37-system.so [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:365 365 ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S: No such f= ile or directory. (gdb) bt #0 __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:365 #1 0x000055555555fea8 in memcpy (__len=3D83, __src=3D0x0, __dest=3D0x7ffff= fffe02d) at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34 #2 sha1_process_bytes (buffer=3D0x0, len=3D452, ctx=3D0x7fffffffdfe0) at tools/sha1.c:210 #3 0x0000555555557d43 in handle_build_id (build_id_size=3D, build_id_offset=3D16, build_id=3D0x555555566448, dso=3D0x5555555678d0) at tools/debugedit.c:3285 #4 main (argc=3D, argv=3D) at tools/debugedi= t.c:3638 ------------------------->8----------------------- If we look a bit deeper we may notice that while processing ".bss" section we're not seeing "u.shdr.sh_type =3D=3D SHT_NOBITS" here https://sourceware.org/git/?p=3Ddebugedit.git;a=3Dblob;f=3Dtools/debugedit.= c;h=3D668777ad47d9b51d0cd118b7d91281963dafa6be;hb=3DHEAD#l3276. Instead we see "u.shdr.sh_type =3D 0x08000000", which is exactly byte-swapp= ed 0x8 which stands for SHT_NOBITS. And since that check doesn't catch NOBITS section we later segfault trying = to process some other garbage. That said there's something wrong with interpretation of a foreign endianes= s. And this could be reproduced with both debugedit & elfutils built from toda= y's "master" barnches. --=20 You are receiving this mail because: You are on the CC list for the bug.=