https://sourceware.org/bugzilla/show_bug.cgi?id=34900
Bug ID: 34900
Summary: elfedit: SIGFPE (division by zero) on a PT_NOTE with
p_align 0 in update_gnu_property
Product: binutils
Version: 2.48 (HEAD)
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: binutils
Assignee: unassigned at sourceware dot org
Reporter: martin.mirchev at u dot nus.edu
Target Milestone: ---
update_gnu_property() in binutils/elfedit.c uses the PT_NOTE segment's p_align
directly as a divisor:
205 if (in.descsz < 8 || (in.descsz % align) != 0)
p_align 0 is valid in ELF (no alignment constraint), so a file with such a
PT_NOTE carrying a GNU property note kills elfedit with SIGFPE when an x86
feature option makes it scan the notes.
Tested on master 1ec1cee48577c7b1960ddce5a6054b3f9fab6ef5. Release: Ubuntu
22.04 gcc 11 -g -O2. ASan: -O1 -g -fsanitize=address,undefined.
Attached (all files in elfedit-palign-zero.tar.gz): elfedit-align0.elf (152
bytes: ELF64 EM_X86_64 ET_EXEC with one
PT_NOTE, p_align 0, holding an NT_GNU_PROPERTY_TYPE_0 note), elfedit-align8.elf
(the same with p_align 8, control) and make_elf.py, which generates both.
$ elfedit --enable-x86-feature ibt elfedit-align0.elf
Floating point exception (core dumped) (exit 136)
$ elfedit --enable-x86-feature ibt elfedit-align8.elf (exit 0)
ASan+UBSan:
binutils/elfedit.c:205:35: runtime error: division by zero
#0 update_gnu_property binutils/elfedit.c:205
#1 process_file binutils/elfedit.c:814
#2 main binutils/elfedit.c:1113
ERROR: AddressSanitizer: FPE on unknown address ...
#0 update_gnu_property binutils/elfedit.c:205
The control is clean in both builds.
p_align values of 0 (and 1) should be treated as "no alignment", or rejected,
before being used as a divisor.
This issue was found by an LLM-Enhanced Static Analysis Engine and verified
manually.
--
You are receiving this mail because:
You are on the CC list for the bug.
