Skip to content

Crashes with str_offsets_buffer_ = NULL #255

@jwbdd

Description

@jwbdd

create_gcov crashes out with

I20251031 13:10:45.626240 3100353 symbol_map.cc:477] Adding loadable exec segment: offset=1ef0ac0 vaddr=1ef1ac0
F20251031 13:10:45.627614 3100353 dwarf2reader.cc:754] Check failed: str_offsets_buffer_ != NULL

On a binary that looks like this:

There are 48 section headers, starting at offset 0x7ce5188:

Section Headers:
  [Nr] Name              Type            Address          Off    Size   ES Flg Lk Inf Al
  [ 0]                   NULL            0000000000000000 000000 000000 00      0   0  0
  [ 1] .interp           PROGBITS        00000000000002e0 0002e0 00001c 00   A  0   0  1
  [ 2] .note.ABI-tag     NOTE            00000000000002fc 0002fc 000020 00   A  0   0  4
  [ 3] .note.gnu.build-id NOTE            000000000000031c 00031c 000020 00   A  0   0  4
  [ 4] .dynsym           DYNSYM          0000000000000340 000340 001620 18   A  8   1  8
  [ 5] .gnu.version      VERSYM          0000000000001960 001960 0001d8 02   A  4   0  2
  [ 6] .gnu.version_r    VERNEED         0000000000001b38 001b38 000180 00   A  8   3  4
  [ 7] .gnu.hash         GNU_HASH        0000000000001cb8 001cb8 00001c 00   A  4   0  8
  [ 8] .dynstr           STRTAB          0000000000001cd4 001cd4 000b23 00   A  0   0  1
  [ 9] .rela.dyn         RELA            00000000000027f8 0027f8 072168 18   A  4   0  8
  [10] .rela.plt         RELA            0000000000074960 074960 001560 18  AI  4  30  8
  [11] .gcc_except_table PROGBITS        0000000000075ec0 075ec0 021068 00   A  0   0  4
  [12] .rodata           PROGBITS        0000000000097000 097000 1d935fa 00 AMS  0   0 4096
  [13] protodesc_cold    PROGBITS        0000000001e2a600 1e2a600 003d50 00   A  0   0 16
  [14] flags_help_cold   PROGBITS        0000000001e2e350 1e2e350 0002ec 00   A  0   0  1
  [15] .eh_frame_hdr     PROGBITS        0000000001e2e63c 1e2e63c 01ecf4 00   A  0   0  4
  [16] .eh_frame         PROGBITS        0000000001e4d330 1e4d330 0a3754 00   A  0   0  8
  [17] .text             PROGBITS        0000000001ef1ac0 1ef0ac0 68e010 00  AX  0   0 64
  [18] .init             PROGBITS        000000000257fad0 257ead0 00001b 00  AX  0   0  4
  [19] .fini             PROGBITS        000000000257faec 257eaec 00000d 00  AX  0   0  4
  [20] __lcxx_override   PROGBITS        000000000257fb00 257eb00 000115 00  AX  0   0 16
  [21] malloc_hook       PROGBITS        000000000257fc16 257ec16 0001d9 00  AX  0   0  2
  [22] .plt              PROGBITS        000000000257fdf0 257edf0 000e50 00  AX  0   0 16
  [23] .tdata            PROGBITS        0000000002581c40 257fc40 000050 00 WAT  0   0 32
  [24] .tbss             NOBITS          0000000002581c90 257fc90 010d45 00 WAT  0   0 16
  [25] .init_array       INIT_ARRAY      0000000002581c90 257fc90 000290 00  WA  0   0  8
  [26] .fini_array       FINI_ARRAY      0000000002581f20 257ff20 000010 00  WA  0   0  8
  [27] .data.rel.ro      PROGBITS        0000000002581f30 257ff30 02d878 00  WA  0   0 16
  [28] .dynamic          DYNAMIC         00000000025af7a8 25ad7a8 0001d0 10  WA  8   0  8
  [29] .got              PROGBITS        00000000025af978 25ad978 0001a0 00  WA  0   0  8
  [30] .got.plt          PROGBITS        00000000025afb18 25adb18 000738 00  WA  0   0  8
  [31] .relro_padding    NOBITS          00000000025b0250 25ae250 000db0 00  WA  0   0  1
  [32] .data             PROGBITS        00000000025b1250 25ae250 00ab08 00  WA  0   0 16
  [33] .bss              NOBITS          00000000025bbd80 25b8d58 2b2d368 00 WAo  0   0 64
  [34] .comment          PROGBITS        0000000000000000 25b8d58 000029 01  MS  0   0  1
  [35] .debug_loclists   PROGBITS        0000000000000000 25b8d81 a05dec 00      0   0  1
  [36] .debug_abbrev     PROGBITS        0000000000000000 2fbeb6d 133364 00      0   0  1
  [37] .debug_info       PROGBITS        0000000000000000 30f1ed1 230d22d 00      0   0  1
  [38] .debug_rnglists   PROGBITS        0000000000000000 53ff0fe 296225 00      0   0  1
  [39] .debug_str_offsets PROGBITS        0000000000000000 5695323 3cb4e8 00      0   0  1
  [40] .debug_str        PROGBITS        0000000000000000 5a6080b 150ca28 01  MS  0   0  1
  [41] .debug_addr       PROGBITS        0000000000000000 6f6d233 2686d0 00      0   0  1
  [42] .debug_line       PROGBITS        0000000000000000 71d5903 837813 00      0   0  1
  [43] .debug_line_str   PROGBITS        0000000000000000 7a0d116 01fd8c 01  MS  0   0  1
  [44] .debug_aranges    PROGBITS        0000000000000000 7a2cea2 000390 00      0   0  1
  [45] .symtab           SYMTAB          0000000000000000 7a2d238 095298 18     47 12194  8
  [46] .shstrtab         STRTAB          0000000000000000 7ac24d0 00020d 00      0   0  1
  [47] .strtab           STRTAB          0000000000000000 7ac26dd 222aaa 00      0   0  1
Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
  L (link order), O (extra OS processing required), G (group), T (TLS),
  C (compressed), x (unknown), o (OS specific), E (exclude),
  D (mbind), l (large), p (processor specific)

The program is built with "-gline-tables-only" and "-fdebug-info-for-profiling" using llvm-19. These are all the accesses to the binary that create_gcov makes before crashing:

pread64(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\32\357\1\0\0\0\0"..., 64, 0) = 64
pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 3072, 130961800) = 3072
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 672, 64) = 672
mmap(NULL, 1757, PROT_READ, MAP_SHARED, 3, 0x7ac2000) = 0x7851a40f3000
mmap(NULL, 8618262, PROT_READ, MAP_SHARED, 3, 0x71d5000) = 0x7851a27d5000
mmap(NULL, 1261265, PROT_READ, MAP_SHARED, 3, 0x2fbe000) = 0x7851a26a1000
mmap(NULL, 36757758, PROT_READ, MAP_SHARED, 3, 0x30f1000) = 0x7851a02f1000
mmap(NULL, 22073907, PROT_READ, MAP_SHARED, 3, 0x5a60000) = 0x78519ec60000
mmap(NULL, 2525443, PROT_READ, MAP_SHARED, 3, 0x6f6d000) = 0x78519e9f7000
mmap(NULL, 2712355, PROT_READ, MAP_SHARED, 3, 0x53ff000) = 0x78519e5ff000
mmap(NULL, 130722, PROT_READ, MAP_SHARED, 3, 0x7a0d000) = 0x7851a30ce000

It doesn't look like it even tried to access .debug_str_offsets.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions