{"header":{"message":"elfedit: repoint all section-naming DT_* tags after a section move","description":"update_dynamic only followed DT_STRTAB/DT_STRSZ/DT_GNU_HASH when\nupdate_section_allocate relocated the leading sections to make room for\nnew program headers. A moved .dynsym left DT_SYMTAB (and DT_VERSYM/\nVERNEED/RELA/...) dangling at the old vaddr, so the loader read those\ntables from stale memory and segfaulted large Rust/PyO3 PIEs (rpds-py,\npydantic-core, ...) at load. Repoint every address-valued DT_* tag that\nnames a section to that section's current addr (no-op when unmoved).\n\nAdds fuzzcheck invariant 6 (each table DT_* points at an allocated\nsection start) plus a deterministic regression test + tightly-packed\nfixture that fails pre-fix (DT_SYMTAB stale) and passes after.\n\nCo-Authored-By: Claude Opus 4.8 ","timestamp":"2026-08-05T05:10:24.893338572Z","authors":[{}]},"hash":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC","authors":[{"login":"pmeunier","key":"AAAAC3NzaC1lZDI1NTE5AAAAILagOJFgwaMNhBWQINinKOXmqS4Gh5NgxgriXwdOoINJ"}],"deps":{"hashes":[["EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC","elfedit: repoint all section-naming DT_* tags after a section move"],["AA",null],["5PJAXSZ7AV7WEGMHTKWFOYWN5YUFRFZDZUXNIMLRPRTADZQEN4JAC","Elfedit: correct reallocation of dynstr/dynamic"],["ZV57M4VN53TJFCOLDOP7I4M4VAEN667SA37LR2HFFKFN5G2MTWIAC","Debugging"],["FRNJITN6RQ2HFEEQX6EKZVZ7PYT2JAIGZX5J25LIVLPV7OLUNYFQC","Elfedit: Error instead of assert when there is no section table"],["OFM2KSL4ROTTZJX7SDYBOIPY4FEEDAE4FF67BKSLFILXBVEDE5BAC","elfedit: widen covering PT_LOAD on in-place section growth (arm64 cross-exec) + cargo-fuzz harness, proptest regressions, repro example"],["AR2X3TLAWGOJH4LY5MHR37V7LP5K6F7LA7CGOKO2FAS7IOTHLXJAC","Initial commit: introducing elfedit"]],"deps":["5PJAXSZ7AV7WEGMHTKWFOYWN5YUFRFZDZUXNIMLRPRTADZQEN4JAC","ZV57M4VN53TJFCOLDOP7I4M4VAEN667SA37LR2HFFKFN5G2MTWIAC","FRNJITN6RQ2HFEEQX6EKZVZ7PYT2JAIGZX5J25LIVLPV7OLUNYFQC","OFM2KSL4ROTTZJX7SDYBOIPY4FEEDAE4FF67BKSLFILXBVEDE5BAC"],"known":["AR2X3TLAWGOJH4LY5MHR37V7LP5K6F7LA7CGOKO2FAS7IOTHLXJAC"]},"hunks":[{"Replacement":{"inode":{"change":6,"pos":69},"path":"elfedit/src/lib.rs","line":1648,"ins":{"up_context":[{"change":4,"pos":1805}],"down_context":[{"change":2,"pos":17507}],"flag":"BLOCK","start":3,"end":2538,"inode":{"change":6,"pos":69}},"del":{"edges":[{"previous":"","flag":"DELETED","from":{"change":4,"pos":1805},"to":{"change":2,"start":17075,"end":17195},"introduced_by":4},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":17075},"to":{"change":2,"start":17075,"end":17195},"introduced_by":2},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":17195},"to":{"change":4,"start":1806,"end":1846},"introduced_by":4},{"previous":"","flag":"DELETED","from":{"change":4,"pos":1846},"to":{"change":2,"start":17234,"end":17414},"introduced_by":4},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":17234},"to":{"change":2,"start":17234,"end":17414},"introduced_by":2},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":17414},"to":{"change":4,"start":1847,"end":1887},"introduced_by":4},{"previous":"","flag":"DELETED","from":{"change":4,"pos":1887},"to":{"change":2,"start":17453,"end":17507},"introduced_by":4},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":17453},"to":{"change":2,"start":17453,"end":17507},"introduced_by":2},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":17507},"to":{"change":3,"start":5104,"end":5234},"introduced_by":3},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":5234},"to":{"change":4,"start":1888,"end":1928},"introduced_by":4},{"previous":"","flag":"DELETED","from":{"change":4,"pos":1928},"to":{"change":3,"start":5273,"end":5327},"introduced_by":4},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":5273},"to":{"change":3,"start":5273,"end":5327},"introduced_by":3}],"inode":{"change":6,"pos":69}},"ins_contents":[{"Add":{"text":" let tag = F::tag(id, *f);","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:36"}},{"Add":{"text":" // DT_STRSZ tracks the .dynstr *size*, not an address.","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:99"}},{"Add":{"text":" if tag == F::dt_strsz() {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:133"}},{"Add":{"text":" if let Some(s) = self.find_section::(b\".dynstr\")? {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:200"}},{"Add":{"text":" F::set_d_un(id, f, self.section(s)?.size(id) as usize);","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:272"}},{"Add":{"text":" }","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:286"}},{"Add":{"text":" return Ok(());","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:313"}},{"Add":{"text":" }","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:323"}},{"Add":{"text":" // Every address-valued DT_* tag that names a single section must follow","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:404"}},{"Add":{"text":" // that section to its current vaddr. update_section_allocate can move the","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:487"}},{"Add":{"text":" // leading sections (.dynsym, .gnu.hash, .gnu.version*, .rela.dyn, ...) to","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:570"}},{"Add":{"text":" // the end of the file to make room for new program headers; if a pointer","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:652"}},{"Add":{"text":" // is left at the old vaddr the loader reads that table from a stale","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:729"}},{"Add":{"text":" // address. Previously only DT_STRTAB/DT_GNU_HASH were repointed, so a","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:808"}},{"Add":{"text":" // moved .dynsym left DT_SYMTAB dangling — which corrupted relocation","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:888"}},{"Add":{"text":" // processing and segfaulted large PIEs (rpds-py and other Rust/PyO3","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:965"}},{"Add":{"text":" // extensions) at load. Repointing to the section's current addr is a","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1043"}},{"Add":{"text":" // no-op when it did not move, so this is safe for every binary.","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1116"}},{"Add":{"text":" let names: &[&[u8]] = if tag == F::dt_strtab() {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1173"}},{"Add":{"text":" &[b\".dynstr\"]","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1199"}},{"Add":{"text":" } else if tag == F::DynTag::from(6) {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1245"}},{"Add":{"text":" &[b\".dynsym\"] // DT_SYMTAB","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1284"}},{"Add":{"text":" } else if tag == F::DynTag::from(4) {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1330"}},{"Add":{"text":" &[b\".hash\"] // DT_HASH","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1365"}},{"Add":{"text":" } else if tag == F::dt_gnuhash() {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1408"}},{"Add":{"text":" &[b\".gnu.hash\"]","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1436"}},{"Add":{"text":" } else if tag == F::DynTag::from(7) {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1482"}},{"Add":{"text":" &[b\".rela.dyn\"] // DT_RELA","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1521"}},{"Add":{"text":" } else if tag == F::DynTag::from(17) {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1568"}},{"Add":{"text":" &[b\".rel.dyn\"] // DT_REL","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1605"}},{"Add":{"text":" } else if tag == F::DynTag::from(23) {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1652"}},{"Add":{"text":" &[b\".rela.plt\", b\".rel.plt\"] // DT_JMPREL","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1706"}},{"Add":{"text":" } else if tag == F::DynTag::from(0x24) {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1755"}},{"Add":{"text":" &[b\".relr.dyn\"] // DT_RELR","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1794"}},{"Add":{"text":" } else if tag == F::DynTag::from(0x6ffffff0) {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1849"}},{"Add":{"text":" &[b\".gnu.version\"] // DT_VERSYM","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1893"}},{"Add":{"text":" } else if tag == F::DynTag::from(0x6ffffffe) {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1948"}},{"Add":{"text":" &[b\".gnu.version_r\"] // DT_VERNEED","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:1995"}},{"Add":{"text":" } else if tag == F::DynTag::from(0x6ffffffc) {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2050"}},{"Add":{"text":" &[b\".gnu.version_d\"] // DT_VERDEF","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2096"}},{"Add":{"text":" } else if tag == F::DynTag::from(25) {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2143"}},{"Add":{"text":" &[b\".init_array\"] // DT_INIT_ARRAY","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2190"}},{"Add":{"text":" } else if tag == F::DynTag::from(26) {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2237"}},{"Add":{"text":" &[b\".fini_array\"] // DT_FINI_ARRAY","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2284"}},{"Add":{"text":" } else {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2301"}},{"Add":{"text":" return Ok(());","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2328"}},{"Add":{"text":" };","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2339"}},{"Add":{"text":" for name in names {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2367"}},{"Add":{"text":" if let Some(s) = self.find_section::(name)? {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2428"}},{"Add":{"text":" F::set_d_un(id, f, self.section(s)?.addr(id) as usize);","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2500"}},{"Add":{"text":" break;","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2523"}},{"Add":{"text":" }","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2537"}}],"del_contents":[{"Del":{"text":" if F::tag(id, *f) == F::dt_strtab() {","pos":"5PJAXSZ7AV7WEGMHTKWFOYWN5YUFRFZDZUXNIMLRPRTADZQEN4JAC:17120"}},{"Del":{"text":" let s = self.find_section::(b\".dynstr\").unwrap().unwrap();","pos":"5PJAXSZ7AV7WEGMHTKWFOYWN5YUFRFZDZUXNIMLRPRTADZQEN4JAC:17194"}},{"Del":{"text":" let sec = self.section(s)?;","pos":"FRNJITN6RQ2HFEEQX6EKZVZ7PYT2JAIGZX5J25LIVLPV7OLUNYFQC:1845"}},{"Del":{"text":" F::set_d_un(id, f, sec.addr(id) as usize)","pos":"5PJAXSZ7AV7WEGMHTKWFOYWN5YUFRFZDZUXNIMLRPRTADZQEN4JAC:17287"}},{"Del":{"text":" } else if F::tag(id, *f) == F::dt_strsz() {","pos":"5PJAXSZ7AV7WEGMHTKWFOYWN5YUFRFZDZUXNIMLRPRTADZQEN4JAC:17339"}},{"Del":{"text":" let s = self.find_section::(b\".dynstr\").unwrap().unwrap();","pos":"5PJAXSZ7AV7WEGMHTKWFOYWN5YUFRFZDZUXNIMLRPRTADZQEN4JAC:17413"}},{"Del":{"text":" let sec = self.section(s)?;","pos":"FRNJITN6RQ2HFEEQX6EKZVZ7PYT2JAIGZX5J25LIVLPV7OLUNYFQC:1886"}},{"Del":{"text":" F::set_d_un(id, f, sec.size(id) as usize)","pos":"5PJAXSZ7AV7WEGMHTKWFOYWN5YUFRFZDZUXNIMLRPRTADZQEN4JAC:17506"}},{"Del":{"text":" } else if F::tag(id, *f) == F::dt_gnuhash() {","pos":"ZV57M4VN53TJFCOLDOP7I4M4VAEN667SA37LR2HFFKFN5G2MTWIAC:5157"}},{"Del":{"text":" let s = self.find_section::(b\".gnu.hash\").unwrap().unwrap();","pos":"ZV57M4VN53TJFCOLDOP7I4M4VAEN667SA37LR2HFFKFN5G2MTWIAC:5233"}},{"Del":{"text":" let sec = self.section(s)?;","pos":"FRNJITN6RQ2HFEEQX6EKZVZ7PYT2JAIGZX5J25LIVLPV7OLUNYFQC:1927"}},{"Del":{"text":" F::set_d_un(id, f, sec.addr(id) as usize)","pos":"ZV57M4VN53TJFCOLDOP7I4M4VAEN667SA37LR2HFFKFN5G2MTWIAC:5326"}}]}},{"Edit":{"inode":{"change":5,"pos":4928},"path":"elfedit/src/fuzzcheck.rs","line":212,"atom":{"NewVertex":{"up_context":[{"change":5,"pos":12654}],"down_context":[{"change":5,"pos":12654}],"flag":"BLOCK","start":2540,"end":2567,"inode":{"change":5,"pos":4928}}},"contents":[{"Add":{"text":"const PT_DYNAMIC: u32 = 2;","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2566"}}]}},{"Edit":{"inode":{"change":5,"pos":4928},"path":"elfedit/src/fuzzcheck.rs","line":296,"atom":{"NewVertex":{"up_context":[{"change":5,"pos":14634}],"down_context":[{"change":5,"pos":14634}],"flag":"BLOCK","start":2568,"end":3255,"inode":{"change":5,"pos":4928}}},"contents":[{"Add":{"text":"/// Read the `(tag, value)` pairs of the `PT_DYNAMIC` array (ELF64 LE), stopping","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2648"}},{"Add":{"text":"/// at the terminating `DT_NULL`.","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2682"}},{"Add":{"text":"fn dyn_entries(b: &[u8]) -> Vec<(i64, u64)> {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2728"}},{"Add":{"text":" let Some(dynp) = phdrs(b).into_iter().find(|p| p.typ == PT_DYNAMIC) else {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2807"}},{"Add":{"text":" return Vec::new();","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2834"}},{"Add":{"text":" };","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2841"}},{"Add":{"text":" let mut off = dynp.offset as usize;","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2881"}},{"Add":{"text":" let end = (dynp.offset + dynp.filesz) as usize;","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2933"}},{"Add":{"text":" let mut out = Vec::new();","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:2963"}},{"Add":{"text":" while off + 16 <= end && off + 16 <= b.len() {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3014"}},{"Add":{"text":" let tag = i64::from_le_bytes(b[off..off + 8].try_into().unwrap());","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3089"}},{"Add":{"text":" let val = u64le(b, off + 8);","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3126"}},{"Add":{"text":" out.push((tag, val));","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3156"}},{"Add":{"text":" if tag == 0 {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3178"}},{"Add":{"text":" break; // DT_NULL","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3208"}},{"Add":{"text":" }","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3218"}},{"Add":{"text":" off += 16;","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3237"}},{"Add":{"text":" }","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3243"}},{"Add":{"text":" out","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3251"}},{"Add":{"text":"}","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3253"}},{"Add":{"text":"","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3254"}}]}},{"Edit":{"inode":{"change":5,"pos":4928},"path":"elfedit/src/fuzzcheck.rs","line":470,"atom":{"NewVertex":{"up_context":[{"change":5,"pos":20576}],"down_context":[{"change":5,"pos":20576}],"flag":"BLOCK","start":3256,"end":5513,"inode":{"change":5,"pos":4928}}},"contents":[{"Add":{"text":" }","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3261"}},{"Add":{"text":"","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3262"}},{"Add":{"text":" // ---- 6. Dynamic table pointers still resolve to a real section. ----","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3338"}},{"Add":{"text":" // When a grown .dynstr must be relocated and there is no room after the","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3415"}},{"Add":{"text":" // program header table, elfedit moves the leading sections (.dynsym,","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3489"}},{"Add":{"text":" // .dynstr, .gnu.hash, .rela.dyn, .relr.dyn, ...) to the end of the file and","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3570"}},{"Add":{"text":" // rewrites their vaddr. The DT_* pointers in .dynamic that *name* those","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3647"}},{"Add":{"text":" // tables must move with them; if one is left at its old vaddr the loader","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3725"}},{"Add":{"text":" // reads that table from stale/unmapped memory. The sharpest symptom is a","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3803"}},{"Add":{"text":" // RELR/RELATIVE entry resolving to the load base instead of base+addend —","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3884"}},{"Add":{"text":" // every large Rust/PyO3 PIE (rpds-py, pydantic-core, ...) then segfaults in","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:3965"}},{"Add":{"text":" // its module init. Guard it: each table-valued DT_* tag must point at the","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4044"}},{"Add":{"text":" // start of some allocated section (which is where the same table's moved","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4122"}},{"Add":{"text":" // shdr now lives).","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4146"}},{"Add":{"text":" if !sh.is_empty() {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4170"}},{"Add":{"text":" // Address-valued tags that always name the *start* of an allocated","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4246"}},{"Add":{"text":" // section (function-address tags like DT_INIT are deliberately excluded).","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4329"}},{"Add":{"text":" const TABLE_TAGS: &[i64] = &[","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4367"}},{"Add":{"text":" 4, // DT_HASH","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4402"}},{"Add":{"text":" 5, // DT_STRTAB","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4439"}},{"Add":{"text":" 6, // DT_SYMTAB","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4476"}},{"Add":{"text":" 7, // DT_RELA","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4511"}},{"Add":{"text":" 17, // DT_REL","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4545"}},{"Add":{"text":" 23, // DT_JMPREL","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4582"}},{"Add":{"text":" 25, // DT_INIT_ARRAY","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4623"}},{"Add":{"text":" 26, // DT_FINI_ARRAY","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4664"}},{"Add":{"text":" 0x24, // DT_RELR","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4699"}},{"Add":{"text":" 0x6ffffef5, // DT_GNU_HASH","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4738"}},{"Add":{"text":" 0x6ffffffc, // DT_VERDEF","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4775"}},{"Add":{"text":" 0x6ffffffe, // DT_VERNEED","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4813"}},{"Add":{"text":" 0x6ffffff0, // DT_VERSYM","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4850"}},{"Add":{"text":" ];","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4861"}},{"Add":{"text":" let sec_addrs: Vec = sh","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4898"}},{"Add":{"text":" .iter()","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4918"}},{"Add":{"text":" .filter(|s| s.flags & SHF_ALLOC != 0 && s.size != 0)","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:4983"}},{"Add":{"text":" .map(|s| s.addr)","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5012"}},{"Add":{"text":" .collect();","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5036"}},{"Add":{"text":" for (tag, ptr) in dyn_entries(patched) {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5085"}},{"Add":{"text":" if !TABLE_TAGS.contains(&tag) {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5129"}},{"Add":{"text":" continue;","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5155"}},{"Add":{"text":" }","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5169"}},{"Add":{"text":" assert!(","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5190"}},{"Add":{"text":" sec_addrs.contains(&ptr),","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5232"}},{"Add":{"text":" \"DT tag {tag:#x} -> vaddr {ptr:#x} is not the start of any allocated \\","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5319"}},{"Add":{"text":" section: a dynamic table pointer was left stale after a section move \\","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5407"}},{"Add":{"text":" (relocations will read from the wrong address); plan={plan:?}\"","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5487"}},{"Add":{"text":" );","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5502"}},{"Add":{"text":" }","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5512"}}]}},{"FileAdd":{"meta":{"basename":"dynamic_pointer_move.rs","metadata":0},"context":[{"change":5,"pos":1}],"contents":[{"Add":{"text":"//! Regression: a grown DT_RUNPATH that forces .dynstr to be relocated must not","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5595"}},{"Add":{"text":"//! leave the DT_* pointers of the *collaterally moved* leading sections (.dynsym,","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5678"}},{"Add":{"text":"//! .gnu.hash, .gnu.version*, ...) dangling at their old vaddr.","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5742"}},{"Add":{"text":"//!","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5746"}},{"Add":{"text":"//! Before the fix, `update_dynamic` only repointed DT_STRTAB/DT_STRSZ/DT_GNU_HASH,","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5830"}},{"Add":{"text":"//! so when `update_section_allocate` moved the sections right after the program","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5911"}},{"Add":{"text":"//! header table to make room for new PT_LOADs, DT_SYMTAB (and friends) still","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:5989"}},{"Add":{"text":"//! pointed at the old address. The dynamic loader then read the symbol table /","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6069"}},{"Add":{"text":"//! relocations from stale memory and segfaulted large PIEs at load — this is","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6149"}},{"Add":{"text":"//! exactly what made `import rpds` (rpds-py, a Rust/PyO3 extension) crash once","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6229"}},{"Add":{"text":"//! elpe had rewritten its RUNPATH.","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6265"}},{"Add":{"text":"//!","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6269"}},{"Add":{"text":"//! The fixture is a small, tightly-packed x86-64 PIE reproducing that layout","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6347"}},{"Add":{"text":"//! (.gnu.hash/.dynsym/.dynstr immediately after the PHT, no gap large enough to","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6428"}},{"Add":{"text":"//! grow .dynstr in place). Rebuild it with:","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6473"}},{"Add":{"text":"//!","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6477"}},{"Add":{"text":"//! printf 'static const int o=1;\\n#define P (&o)\\n#define P8 P,P,P,P,P,P,P,P\\n\\","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6562"}},{"Add":{"text":"//! #define P64 P8,P8,P8,P8,P8,P8,P8,P8\\nconst void *t[]={%s};\\n\\","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6632"}},{"Add":{"text":"//! int elfedit_probe(int x){return *(const int*)t[x&1535];}\\n' \\","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6702"}},{"Add":{"text":"//! \"$(python3 -c 'print(\",\".join([\"P64\"]*24))')\" > reloc_move.c","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6773"}},{"Add":{"text":"//! cc -shared -fPIC -O2 -o reloc_move.so reloc_move.c \\","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6834"}},{"Add":{"text":"//! -Wl,--build-id=none -Wl,--hash-style=gnu -Wl,-z,noseparate-code -nostartfiles -s","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6926"}},{"Add":{"text":"#![cfg(feature = \"fuzzing\")]","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6955"}},{"Add":{"text":"","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6956"}},{"Add":{"text":"use elfedit::fuzzcheck::{self, EditPlan};","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6998"}},{"Add":{"text":"","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:6999"}},{"Add":{"text":"const FIXTURE: &[u8] = include_bytes!(\"fixtures/reloc_move.so\");","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7064"}},{"Add":{"text":"","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7065"}},{"Add":{"text":"#[test]","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7073"}},{"Add":{"text":"fn runpath_growth_keeps_dynamic_pointers_valid() {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7124"}},{"Add":{"text":" // ~48 distinct store-path entries: comfortably larger than any in-file gap,","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7205"}},{"Add":{"text":" // so .dynstr cannot grow in place and the leading sections get relocated.","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7284"}},{"Add":{"text":" let mut rp = Vec::new();","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7313"}},{"Add":{"text":" for i in 0..48 {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7334"}},{"Add":{"text":" if i > 0 {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7353"}},{"Add":{"text":" rp.push(b':');","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7380"}},{"Add":{"text":" }","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7390"}},{"Add":{"text":" rp.extend_from_slice(","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7420"}},{"Add":{"text":" format!(\"/elpe/store/{i:0>60}-lib{i}_1.0_amd64/usr/lib/x86_64-linux-gnu\").as_bytes(),","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7518"}},{"Add":{"text":" );","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7529"}},{"Add":{"text":" }","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7535"}},{"Add":{"text":" let plan = EditPlan {","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7561"}},{"Add":{"text":" runpath: Some(rp),","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7588"}},{"Add":{"text":" ..Default::default()","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7617"}},{"Add":{"text":" };","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7624"}},{"Add":{"text":" let patched = fuzzcheck::apply(FIXTURE, &plan);","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7676"}},{"Add":{"text":" // Invariant 6 (dynamic table pointers resolve to a real section) is the one","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7757"}},{"Add":{"text":" // that fails pre-fix, with DT_SYMTAB left at the pre-move .dynsym vaddr.","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7835"}},{"Add":{"text":" fuzzcheck::check_invariants(FIXTURE, &patched, &plan);","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7894"}},{"Add":{"text":"}","pos":"EAD33KLTGX5UZSM5Y7YM42R7YQ43FBKCB675A67QD74NFUO6MU6QC:7896"}}]}},{"FileAdd":{"meta":{"basename":"fixtures","metadata":576},"context":[{"change":5,"pos":1}],"contents":[]}},{"FileAdd":{"meta":{"basename":"reloc_move.so","metadata":64},"context":[{"change":0,"pos":7948}],"contents":[]}}],"owner":"pmeunier","repo":"elpe","token":"t9/iq38Yk6+g+7XPAaa6nwY3gcrS1D7QTeYroaI6ooQ=","login":null}

…

Dependencies

Change contents

Review