DynamoRIO / DynamoRIO/dynamorio
CRASH: DynamoRIO segfaults when the ELF contains an empty segment
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
**Describe the bug**
If the application contains an empty ELF segment, the private loader of DynamoRIO segfaults. No log is generated. The bug was noticed under an AArch64 environment. I haven't tested what happens under x86.
**To Reproduce**
Steps to reproduce the behavior:
1. Create the following two files:
```assembly
# prog.S
_start:
mov x0, #0x0
mov x8, #0x5d
svc #0x0
.global _start
```
```linker
/* myscript.lds */
PHDRS {
headers PT_PHDR PHDRS ;
text PT_LOAD FILEHDR PHDRS ;
data PT_LOAD ;
}
SECTIONS {
. = 0x10000 ;
. += SIZEOF_HEADERS ;
.text : { *(.text*) } :text
.rodata : { *(.rodata*) } :text
. = ALIGN(0x1000) ;
.data : { *(.data*) } :data
.bss : { *(.bss) } :data
}
```
Compile the above two files with `as prog.S -o prog.o` and `ld -T myscript.lds -e _start -o prog prog.o`.
This results in an executable `prog` with an empty data segment. `readelf` shows the following headers:
```text
Section Headers:
[Nr] Name Type Address Offset
Size EntSize Flags Link Info Align
[ 0] NULL 0000000000000000 00000000
0000000000000000 0000000000000000 0 0 0
[ 1] .text PROGBITS 00000000000100e8 000000e8
000000000000000c 0000000000000000 AX 0 0 4
[ 2] .symtab SYMTAB 0000000000000000 000000f8
0000000000000078 0000000000000018 3 4 8
[ 3] .strtab STRTAB 0000000000000000 00000170
0000000000000012 0000000000000000 0 0 1
[ 4] .shstrtab STRTAB 0000000000000000 00000182
0000000000000021 0000000000000000 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
L (link order), O (extra OS processing required), G (group), T (TLS),
C (compressed), x (unknown), o (OS specific), E (exclude),
D (mbind), p (processor specific)
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
PHDR 0x0000000000000040 0x0000000000010040 0x0000000000010040
0x00000000000000a8 0x00000000000000a8 R 0x8
LOAD 0x0000000000000000 0x0000000000010000 0x0000000000010000
0x00000000000000f4 0x00000000000000f4 R E 0x10000
LOAD 0x00000000000000f4 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x10000
Section to Segment mapping:
Segment Sections...
00
01 .text
02
```
The executable runs fine under Linux, but running it under DynamoRIO causes DynamoRIO to segfault immediately.
Please also answer these questions:
- What happens when you run without any client?
The segfault still happens.
- What happens when you run with debug build ("-debug" flag to drrun/drconfig/drinject)?
The following error message was emitted:
```text
```
Please provide a symbolized callstack of any crash or assert so we do not have to speculate or guess as to where it is occurring (see our [Linux gdb instructions](https://dynamorio.org/page_debugging.html#autotoc_md146) and [Windows windbg instructions](https://dynamorio.org/page_debugging.html#autotoc_md157) to see how to load DynamoRIO symbols for a callstack).
```text
Program received signal SIGSEGV, Segmentation fault.
privload_setup_auxv (exe_path=0x7fffffffbe "/root/test/prog", interp_map=0x0,
delta=549551464448, map=0x7ff3d1e000 "", envp=)
at /home/runner/work/dynamorio/dynamorio/core/unix/loader.c:1744
1744 auxv->a_un.a_val = (ptr_int_t)map + elf->e_phoff;
(gdb) backtrace
#0 privload_setup_auxv (exe_path=0x7fffffffbe "/root/test/prog",
interp_map=0x0, delta=549551464448, map=0x7ff3d1e000 "",
envp=)
at /home/runner/work/dynamorio/dynamorio/core/unix/loader.c:1744
#1 privload_early_inject (sp=0x7ffffff520, old_libdr_base=,
old_libdr_size=)
at /home/runner/work/dynamorio/dynamorio/core/unix/loader.c:2331
#2 0x0000007ff7f17234 in _start ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
```
**Expected behavior**
DynamoRIO should execute the application without crashes.
**Screenshots or Pasted Text**
See above.
**Versions**
- What version of DynamoRIO are you using?
11.3.0
- Does the latest build from https://github.com/DynamoRIO/dynamorio/releases solve the problem?
I didn't have time to test
- What operating system version are you running on? ("Windows 10" is *not* sufficient: give the release number.)
Ubuntu 25.04 AArch64
- Is your application 32-bit or 64-bit?
64-bit
**Additional context**
For a research project we had to use a custom linker script to build ELF images, and the script occasionally produced empty segments, which was how we noticed the issue. Running `strip` over the ELF removes the empty segment and resolved the issue.
Contributor guide
Assessment
This issue has not been assessed yet.