DynamoRIO / DynamoRIO/dynamorio

CRASH: DynamoRIO segfaults when the ELF contains an empty segment

Open
#7,522 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

**Describe the bug**
If the application contains an empty ELF segment, the private loader of DynamoRIO segfaults. No log is generated. The bug was noticed under an AArch64 environment. I haven't tested what happens under x86.

**To Reproduce**
Steps to reproduce the behavior:
1. Create the following two files:
```assembly
# prog.S
_start:
mov x0, #0x0
mov x8, #0x5d
svc #0x0
.global _start
```

```linker
/* myscript.lds */
PHDRS {
headers PT_PHDR PHDRS ;
text PT_LOAD FILEHDR PHDRS ;
data PT_LOAD ;
}

SECTIONS {
. = 0x10000 ;
. += SIZEOF_HEADERS ;
.text : { *(.text*) } :text
.rodata : { *(.rodata*) } :text
. = ALIGN(0x1000) ;
.data : { *(.data*) } :data
.bss : { *(.bss) } :data
}
```

Compile the above two files with `as prog.S -o prog.o` and `ld -T myscript.lds -e _start -o prog prog.o`.
This results in an executable `prog` with an empty data segment. `readelf` shows the following headers:

```text
Section Headers:
[Nr] Name Type Address Offset
Size EntSize Flags Link Info Align
[ 0] NULL 0000000000000000 00000000
0000000000000000 0000000000000000 0 0 0
[ 1] .text PROGBITS 00000000000100e8 000000e8
000000000000000c 0000000000000000 AX 0 0 4
[ 2] .symtab SYMTAB 0000000000000000 000000f8
0000000000000078 0000000000000018 3 4 8
[ 3] .strtab STRTAB 0000000000000000 00000170
0000000000000012 0000000000000000 0 0 1
[ 4] .shstrtab STRTAB 0000000000000000 00000182
0000000000000021 0000000000000000 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
L (link order), O (extra OS processing required), G (group), T (TLS),
C (compressed), x (unknown), o (OS specific), E (exclude),
D (mbind), p (processor specific)

Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
PHDR 0x0000000000000040 0x0000000000010040 0x0000000000010040
0x00000000000000a8 0x00000000000000a8 R 0x8
LOAD 0x0000000000000000 0x0000000000010000 0x0000000000010000
0x00000000000000f4 0x00000000000000f4 R E 0x10000
LOAD 0x00000000000000f4 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x10000

Section to Segment mapping:
Segment Sections...
00
01 .text
02
```

The executable runs fine under Linux, but running it under DynamoRIO causes DynamoRIO to segfault immediately.

Please also answer these questions:
- What happens when you run without any client?
The segfault still happens.
- What happens when you run with debug build ("-debug" flag to drrun/drconfig/drinject)?
The following error message was emitted:
```text

```

Please provide a symbolized callstack of any crash or assert so we do not have to speculate or guess as to where it is occurring (see our [Linux gdb instructions](https://dynamorio.org/page_debugging.html#autotoc_md146) and [Windows windbg instructions](https://dynamorio.org/page_debugging.html#autotoc_md157) to see how to load DynamoRIO symbols for a callstack).

```text
Program received signal SIGSEGV, Segmentation fault.
privload_setup_auxv (exe_path=0x7fffffffbe "/root/test/prog", interp_map=0x0,
delta=549551464448, map=0x7ff3d1e000 "", envp=)
at /home/runner/work/dynamorio/dynamorio/core/unix/loader.c:1744
1744 auxv->a_un.a_val = (ptr_int_t)map + elf->e_phoff;
(gdb) backtrace
#0 privload_setup_auxv (exe_path=0x7fffffffbe "/root/test/prog",
interp_map=0x0, delta=549551464448, map=0x7ff3d1e000 "",
envp=)
at /home/runner/work/dynamorio/dynamorio/core/unix/loader.c:1744
#1 privload_early_inject (sp=0x7ffffff520, old_libdr_base=,
old_libdr_size=)
at /home/runner/work/dynamorio/dynamorio/core/unix/loader.c:2331
#2 0x0000007ff7f17234 in _start ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
```

**Expected behavior**
DynamoRIO should execute the application without crashes.

**Screenshots or Pasted Text**
See above.

**Versions**
- What version of DynamoRIO are you using?
11.3.0
- Does the latest build from https://github.com/DynamoRIO/dynamorio/releases solve the problem?
I didn't have time to test
- What operating system version are you running on? ("Windows 10" is *not* sufficient: give the release number.)
Ubuntu 25.04 AArch64
- Is your application 32-bit or 64-bit?
64-bit

**Additional context**
For a research project we had to use a custom linker script to build ELF images, and the script occasionally produced empty segments, which was how we noticed the issue. Running `strip` over the ELF removes the empty segment and resolved the issue.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.