[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Readelf bug

From: Vsevolod Alekseyev
Subject: Readelf bug
Date: Wed, 1 Jun 2022 21:33:32 -0400

I’m debugging a DWARF parser library. We are testing it against GNU readelf, and we’ve found a discrepancy on the dump of the interpreted .eh_frame section of a particular x86_64 ELF binary.


The binary’s first FDE in .eh_frame has initial_location 0x1060, and the following instructions:


DW_CFA_advance_loc 4                                # Move PC by 4

DW_CFA_undefined 16                                 # Change the rule for R16 to undefined


The linked CIE marks R16 as the return address, and has the following instructions:


DW_CFA_def_cfa 7, 8                     # CFA is at R7+8)

DW_CFA_offset 16, 1                      # Set the rule for R16 to [CFA+1*data_aligment_factor])


The GNU readelf, if executed with --debug-dump=frames-interp, dumps the FDE as follows:


00000018 0000000000000014 0000001c FDE cie=00000000 pc=0000000000001060..0000000000001086

     LOC           CFA      ra   

0000000000001060 rsp+8    u    

0000000000001064 rsp+8    u


Meanwhile, the alternative parser thinks that at the range [0x1060-0x1064), the rule for RA/R16 should be as inherited from the CIE, and it goes rsp+8.


I’ve debugged readelf (the latest master, as of 06/01/22), to that point. There are two passes over the FDE instructions: one starting on dwarf.c:9296, the other starting at dwarf.c:9442. On the first pass, when DW_CFA_undefined is encountered, there is the following case statement:


READ_ULEB (reg, start, block_end);

if (frame_need_space (fc, reg) >= 0)

    fc->col_type[reg] = DW_CFA_undefined;



If I understand correctly, the intended purpose of the first pass is to allocate enough memory in the fc->col_type and fc->col_offset arrays, and the logic of this operator’s handling was meant to be: if this register was not mentioned before, allocate space for it, and reset its rule to undefined. HOWEVER, if the register WAS mentioned before (e. g. in the CIE), frame_need_space() returns 0, and the if() body executes anyway, and resets the rule for the register to undefined, erasing the initial state as specified by the CIE.


I think the if statement should go, instead, “if (frame_need_space (fc, reg) > 0)”. Same for other register-rule-type operators on the first pass.


The binary can be seen at https://github.com/eliben/pyelftools/issues/409#issuecomment-1136720254


I’d submit a Bugzilla ticket, but registration is closed.


Thank you!

reply via email to

[Prev in Thread] Current Thread [Next in Thread]