Audit finds 32 unguarded sreloc-NULL sites across 8 ELF backends
An audit identified 32 potential NULL pointer dereferences related to 'sreloc' across multiple ELF backends in binutils, requiring NULL checks similar to a rec…
Following a fix for PR ld/34448, an audit has uncovered 32 additional sites across 8 ELF backends in binutils where ‘sreloc’ is dereferenced without a preceding NULL check. These sites share the same vulnerability as the one already fixed: the linker may skip dynamic relocation section creation upon encountering a relocation error, leading to a NULL pointer dereference if code assumes the section exists. The proposed solution involves adding local NULL checks at each identified site.
In Details
This discussion details a security audit following a fix for PR ld/34448. The audit identified numerous instances in various ELF backends (x86, arm, ppc, s390, riscv, aarch64, tilepro) where elf_section_data(...)->sreloc is accessed without checking if sreloc is NULL. This condition can arise if elf_link_read_relocs_from_section aborts due to a bad relocation, and subsequent code expects the dynamic relocation section to exist. The proposed solution involves generalizing the fix from commit 0a84e560216 by adding appropriate NULL checks tailored to the control flow at each site.
- sreloc
- Likely refers to 'static relocation' or 'symbol relocation', a data structure used during linking to record information about symbol references and their memory addresses.
- ELF backends
- Specific code within the binutils linker that handles the ELF (Executable and Linkable Format) object file format for different processor architectures (e.g., x86, ARM, RISC-V).
- NULL pointer dereference
- An error that occurs when a program attempts to access memory through a pointer that is NULL (points to nothing), often leading to a crash.
- dynamic relocation section
- A section within an object file or executable that contains information needed to resolve symbol references at runtime. This is crucial for dynamically linked executables.