binutils Newspaper
JULY 29, 2026
Date
/
Architectures
Components
Topics
News & Policy
Other
binutils/readelf

Update dynamic tag processing and validate section info.

readelf now counts DT_RELR relocations using dynamic tags and validates section header info to prevent segfaults.

This update enhances readelf’s ability to process ELF files by accurately counting DT_RELR relocations using dynamic tags when section headers are unavailable. It also adds validation for section header offsets and sizes, preventing segfaults caused by out-of-range values. A side effect is the display of warnings for ignored invalid section data.

In Details

This patch enhances readelf's handling of relocations and section validation. It implements count_relr_relocations to use dynamic tags (DT_RELSZ, DT_RELASZ) for relocation counts, addressing PR binutils/34326. A new validate_section_info function is introduced to check and sanitize sh_offset and sh_size against file size, preventing segfaults as reported in PR binutils/34339. The scope extends to get_32bit_section_headers and get_64bit_section_headers in binutils/readelf.c and includes testsuite updates in ld/.

For Context
readelf
A utility that displays information about ELF (Executable and Linkable Format) files.
ELF
Executable and Linkable Format, a standard file format for executables, object code, shared libraries, and core dumps on Unix-like systems.
dynamic tag
Tags within the ELF dynamic section (e.g., DT_RELR, DT_RELSZ) that provide information for dynamic linking and execution.
section header
A structure in an ELF file that describes a section, containing information such as its name, type, and location in the file.
DT_RELR
An ELF dynamic tag used to indicate the presence and location of relocation entries.
sh_offset
A field in an ELF section header that specifies the offset of the section from the beginning of the file.
sh_size
A field in an ELF section header that specifies the size of the section in bytes.
segfault
A segmentation fault, an error that occurs when a program accesses a memory location that it is not allowed to access.
Filed Under: binutilsreadelfelfvalidationbugfix