Bug 72705 – Segfault from prelink

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 72705 - Segfault from prelink

Summary:	Segfault from prelink

Status:	CLOSED RAWHIDE

Aliases:	None

Product:	Red Hat Linux
Classification:	Retired
Component:	prelink (Show other bugs)
Sub Component:
Version:	8.0
Hardware:	i386 Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Jakub Jelinek
QA Contact:
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2002-08-26 15:26 EDT by Owen Taylor
Modified:	2007-04-18 12:46 EDT (History)
CC List:	1 user (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2003-08-29 16:31:42 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
gnome-terminal binary reproducing the problem (313.90 KB, application/octet-stream) 2002-08-26 15:44 EDT, Owen Taylor	no flags	Details
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Owen Taylor 2002-08-26 15:26:07 EDT

If you run 

 /usr/sbin/prelink -u 

On the attached binary, prelink segfaults almost immediately.
It's before it reads any other files, so I suspect it
will be reproducable.

I'm not sure if the binary is corrupt or not; if it is
corrupt, that's another prelink bug, but I can't give
a reproduction sequence, I'm afraid. It was something
like:

 prelink -a -v
 prelink -a -u -v
 prelink /usr/bin/gnome-terminal
 [ upgrade openssl, which is indirectly pulled in by gnome-terminal ]
 prelink -a -u

With gnome-terminal and libraries mostly from the 
Milan tree.

Comment 1 Owen Taylor 2002-08-26 15:44:55 EDT

Created attachment 73164 [details]
gnome-terminal binary reproducing the problem

Comment 2 Jakub Jelinek 2002-08-27 03:18:13 EDT

The binary is in fact broken, sh_link member of .gnu.liblist Shdr has
completely bogus value. Not segfaulting on it will be trivial, will try to
look where it might come from too.

Comment 3 Jakub Jelinek 2002-08-27 10:59:13 EDT

--- exec.c~     2002-08-27 16:35:51.000000000 +0200
+++ exec.c      2002-08-27 16:35:51.000000000 +0200
@@ -793,7 +793,7 @@ prelink_exec (struct prelink_info *info)
       Elf_Data *data;

       dso->shdr[i].sh_link
-       = new_dynstr ? new[new_dynstr] : move->old_to_new[dynstrndx];
+       = new_dynstr != -1 ? new[new_dynstr] : move->old_to_new[dynstrndx];
       data = elf_getdata (dso->scn[i], NULL);
       data->d_type = ELF_T_WORD;
       data->d_size = (ndeps - 1) * sizeof (Elf32_Lib);

seems like the candidate why sh_link was garbage (new[-1]).
I've added checks so that prelink -u wouldn't segfault on bogus sh_link or
sh_info fields too.
Will be soon in prelink-0.2.0-8.

Comment 4 Bill Nottingham 2003-08-29 16:31:42 EDT

Assuming fixed in current versions.

Note You need to log in before you can comment on or make changes to this bug.