[Bug ld/20241] plugin lto + archive: invalid read access might cause SIGSEGV

[frederic.germain at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=20241

--- Comment #2 from Frédéric Germain <frederic.germain at gmail dot com> ---
So sorry, it's indeed the trace from
arm-none-eabi-binutils-cs-2.25-2.fc23.src.rpm, so a 2.25 version

I made more test on HEAD. actually, the bug happens only on thin archive (T
option in ar)
here a simple script to be able to get into this condition

````
echo -e "int main(int argc, const char** argv){ return 0;}\n\n" > prog.c
gcc -flto -c prog.c -o prog.o
rm -f prog.a && gcc-ar crsT prog.a prog.o
gcc -flto prog.a -Wl,-fuse-ld=bfd -Wl,--verbose
````

I used "strace -f -s 256 -v gcc -flto prog.a -Wl,-fuse-ld=bfd -Wl,--verbose
2>&1 |grep execve" to get ld command that is run by gcc


==24927== Invalid read of size 8
==24927==    at 0x41E0D0: vfinfo (ldmisc.c:233)
==24927==    by 0x41E727: info_msg (ldmisc.c:452)
==24927==    by 0x418E81: add_archive_element (ldmain.c:902)
==24927==    by 0x4EB5155: elf_link_add_archive_symbols (elflink.c:5306)
==24927==    by 0x4EB5155: bfd_elf_link_add_symbols (elflink.c:5362)
==24927==    by 0x412F8F: load_symbols (ldlang.c:2874)
==24927==    by 0x413B0E: open_input_bfds (ldlang.c:3323)
==24927==    by 0x416039: lang_process (ldlang.c:6826)
==24927==    by 0x405363: main (ldmain.c:415)
==24927==  Address 0x578e270 is 208 bytes inside a block of size 280 free'd
==24927==    at 0x4C29CF0: free (vg_replace_malloc.c:530)
==24927==    by 0x4E85AA6: bfd_close (opncls.c:745)
==24927==    by 0x421E74: plugin_maybe_claim (plugin.c:1207)
==24927==    by 0x418D52: add_archive_element (ldmain.c:802)
==24927==    by 0x4EB5155: elf_link_add_archive_symbols (elflink.c:5306)
==24927==    by 0x4EB5155: bfd_elf_link_add_symbols (elflink.c:5362)
==24927==    by 0x412F8F: load_symbols (ldlang.c:2874)
==24927==    by 0x413B0E: open_input_bfds (ldlang.c:3323)
==24927==    by 0x416039: lang_process (ldlang.c:6826)
==24927==    by 0x405363: main (ldmain.c:415)
==24927==  Block was alloc'd at
==24927==    at 0x4C28BF6: malloc (vg_replace_malloc.c:299)
==24927==    by 0x4E7FD62: bfd_malloc (libbfd.c:184)
==24927==    by 0x4E7FF0D: bfd_zmalloc (libbfd.c:269)
==24927==    by 0x4E8551A: _bfd_new_bfd (opncls.c:61)
==24927==    by 0x4E85717: bfd_fopen (opncls.c:199)
==24927==    by 0x4E77347: open_nested_file (archive.c:390)
==24927==    by 0x4E7810A: _bfd_get_elt_at_filepos (archive.c:699)
==24927==    by 0x4EB5109: elf_link_add_archive_symbols (elflink.c:5297)
==24927==    by 0x4EB5109: bfd_elf_link_add_symbols (elflink.c:5362)
==24927==    by 0x412F8F: load_symbols (ldlang.c:2874)
==24927==    by 0x413B0E: open_input_bfds (ldlang.c:3323)
==24927==    by 0x416039: lang_process (ldlang.c:6826)
==24927==    by 0x405363: main (ldmain.c:415)

-- 
You are receiving this mail because:
You are on the CC list for the bug.