ld: microblaze: don't index the local symbol cache with a global symbol index
Fix an out-of-bounds read in microblaze ELF relaxation that silently corrupts relocation addends.
This patch addresses a bug in the microblaze ELF relaxation code where an out-of-bounds read can corrupt relocation addends, leading to silent miscompilations. The issue arises from indexing a local symbol cache with a global symbol index without proper bounds checking. The fix restores a missing bounds check, preventing incorrect adjustment of relocation addends and ensuring data structure accesses are compiled correctly.
- proposer
Proposes to add a missing bounds check to the microblaze ELF relaxation code to prevent out-of-bounds reads that corrupt relocation addends.
“microblaze_elf_relax_section() was copied from sh_elf_relax_delete_bytes() in 2009 (7ba29e2a41) but the copy dropped a bounds check that was already present in the sh original. This adds the missing two-line guard from bfd/elf32-sh.c:1227-1228, preventing an out-of-bounds read that silently corrupts relocation addends.”
In Details
The microblaze ELF relaxation code in binutils' ld is missing a bounds check, analogous to the one present in the sh ELF relaxation code. This allows an out-of-bounds read when indexing the local symbol buffer isymbuf with a global symbol index. If the out-of-bounds data resembles a local symbol for the current section, relocation addends can be miscalculated, causing silent code corruption, particularly with structure member accesses at optimization levels like -O2.
- ELF relaxation
- A linker optimization pass that adjusts relocation addends to account for code/data size changes during linking. This is crucial for certain instruction sets and addressing modes to maintain correctness.
- relocation addend
- A value embedded in an object file that is added to a symbol's address to form the final address of a reference. During relaxation, this addend might be modified.
- microblaze
- A 32-bit RISC soft processor core from Xilinx, often used in FPGAs. Binutils supports targeting this architecture.
- isymbuf
- In binutils' BFD library, this likely refers to a buffer holding local symbols for a specific section, as opposed to global symbols in the main symbol table.