Re: Noop round trip through elf_update() causes segfaults

[Mark Wielaard <mark@klomp.org>]

Hi Daniel,

On Wed, Dec 27, 2023 at 08:40:09PM -0600, Daniel Xu wrote:
> I was working on code that adds an ELF section containing custom
> metadata to ELF binaries when I started getting odd segfaults
> in the added-to binary.
> 
> I've managed to create a minimal reproducer with a couple interesting
> discoveries. The reproducer is available here:
> 
>         https://github.com/danobi/elf-segfault
> 
> Basically it does a noop round trip between elf_begin() and elf_update().
> But the resulting binary, when run, outputs:
> 
>         $ ./testprog_copy
>         fish: Job 1, './testprog_copy' terminated by signal SIGSEGV (Address boundary error)
> 
> Furthermore, I built and ran tests/addsections.c [0] against my testbinary
> and I still get:
> 
>         $ ./testprog_copy_elfutils
>         fish: Job 1, './testprog_copy_elfutils' terminated by signal SIGSEGV (Address boundary error)
>  
> I've also tried linking against upstream libelf built from source
> with the same results.
> 
> This leads me to believe I'm doing something very wrong or
> I'm hitting a bug.

You aren't doing something very wrong, but libelf does something you
aren't expecting. When you are calling elf_update () it will rearrange
the elf sections making sure there are no unnecessary gaps between the
sections in the file, that alignment is correct, etc.

libelf only cares about the section headers. It doesn't know/care
about the program headers. The program headers describe how the
segments have to be loaded at runtime. Since some data has moved
around the program data isn't loaded correctly anymore which causes
the crash.

To prevent libelf from doing this, and take responsibility of how the
sections are layed out yourself you have to call:

  elf_flagelf (elf, ELF_C_SET, ELF_F_LAYOUT);

Before calling elf_update. Note that in that case you are responsible
for setting/updating the sh_offset fields of the Shdrs yourself.

See for example the elfutils src/elfcompress.c program to see what it
does in case the Elf file has program headers.

Hope that helps,

Mark