Skip to content

Crashes with str_offsets_buffer_ = NULL #255

@jwbdd

Description

@jwbdd

create_gcov crashes out with

I20251031 13:10:45.626240 3100353 symbol_map.cc:477] Adding loadable exec segment: offset=1ef0ac0 vaddr=1ef1ac0
F20251031 13:10:45.627614 3100353 dwarf2reader.cc:754] Check failed: str_offsets_buffer_ != NULL

On a binary that looks like this:

There are 48 section headers, starting at offset 0x7ce5188:

Section Headers:
  [Nr] Name              Type            Address          Off    Size   ES Flg Lk Inf Al
  [ 0]                   NULL            0000000000000000 000000 000000 00      0   0  0
  [ 1] .interp           PROGBITS        00000000000002e0 0002e0 00001c 00   A  0   0  1
  [ 2] .note.ABI-tag     NOTE            00000000000002fc 0002fc 000020 00   A  0   0  4
  [ 3] .note.gnu.build-id NOTE            000000000000031c 00031c 000020 00   A  0   0  4
  [ 4] .dynsym           DYNSYM          0000000000000340 000340 001620 18   A  8   1  8
  [ 5] .gnu.version      VERSYM          0000000000001960 001960 0001d8 02   A  4   0  2
  [ 6] .gnu.version_r    VERNEED         0000000000001b38 001b38 000180 00   A  8   3  4
  [ 7] .gnu.hash         GNU_HASH        0000000000001cb8 001cb8 00001c 00   A  4   0  8
  [ 8] .dynstr           STRTAB          0000000000001cd4 001cd4 000b23 00   A  0   0  1
  [ 9] .rela.dyn         RELA            00000000000027f8 0027f8 072168 18   A  4   0  8
  [10] .rela.plt         RELA            0000000000074960 074960 001560 18  AI  4  30  8
  [11] .gcc_except_table PROGBITS        0000000000075ec0 075ec0 021068 00   A  0   0  4
  [12] .rodata           PROGBITS        0000000000097000 097000 1d935fa 00 AMS  0   0 4096
  [13] protodesc_cold    PROGBITS        0000000001e2a600 1e2a600 003d50 00   A  0   0 16
  [14] flags_help_cold   PROGBITS        0000000001e2e350 1e2e350 0002ec 00   A  0   0  1
  [15] .eh_frame_hdr     PROGBITS        0000000001e2e63c 1e2e63c 01ecf4 00   A  0   0  4
  [16] .eh_frame         PROGBITS        0000000001e4d330 1e4d330 0a3754 00   A  0   0  8
  [17] .text             PROGBITS        0000000001ef1ac0 1ef0ac0 68e010 00  AX  0   0 64
  [18] .init             PROGBITS        000000000257fad0 257ead0 00001b 00  AX  0   0  4
  [19] .fini             PROGBITS        000000000257faec 257eaec 00000d 00  AX  0   0  4
  [20] __lcxx_override   PROGBITS        000000000257fb00 257eb00 000115 00  AX  0   0 16
  [21] malloc_hook       PROGBITS        000000000257fc16 257ec16 0001d9 00  AX  0   0  2
  [22] .plt              PROGBITS        000000000257fdf0 257edf0 000e50 00  AX  0   0 16
  [23] .tdata            PROGBITS        0000000002581c40 257fc40 000050 00 WAT  0   0 32
  [24] .tbss             NOBITS          0000000002581c90 257fc90 010d45 00 WAT  0   0 16
  [25] .init_array       INIT_ARRAY      0000000002581c90 257fc90 000290 00  WA  0   0  8
  [26] .fini_array       FINI_ARRAY      0000000002581f20 257ff20 000010 00  WA  0   0  8
  [27] .data.rel.ro      PROGBITS        0000000002581f30 257ff30 02d878 00  WA  0   0 16
  [28] .dynamic          DYNAMIC         00000000025af7a8 25ad7a8 0001d0 10  WA  8   0  8
  [29] .got              PROGBITS        00000000025af978 25ad978 0001a0 00  WA  0   0  8
  [30] .got.plt          PROGBITS        00000000025afb18 25adb18 000738 00  WA  0   0  8
  [31] .relro_padding    NOBITS          00000000025b0250 25ae250 000db0 00  WA  0   0  1
  [32] .data             PROGBITS        00000000025b1250 25ae250 00ab08 00  WA  0   0 16
  [33] .bss              NOBITS          00000000025bbd80 25b8d58 2b2d368 00 WAo  0   0 64
  [34] .comment          PROGBITS        0000000000000000 25b8d58 000029 01  MS  0   0  1
  [35] .debug_loclists   PROGBITS        0000000000000000 25b8d81 a05dec 00      0   0  1
  [36] .debug_abbrev     PROGBITS        0000000000000000 2fbeb6d 133364 00      0   0  1
  [37] .debug_info       PROGBITS        0000000000000000 30f1ed1 230d22d 00      0   0  1
  [38] .debug_rnglists   PROGBITS        0000000000000000 53ff0fe 296225 00      0   0  1
  [39] .debug_str_offsets PROGBITS        0000000000000000 5695323 3cb4e8 00      0   0  1
  [40] .debug_str        PROGBITS        0000000000000000 5a6080b 150ca28 01  MS  0   0  1
  [41] .debug_addr       PROGBITS        0000000000000000 6f6d233 2686d0 00      0   0  1
  [42] .debug_line       PROGBITS        0000000000000000 71d5903 837813 00      0   0  1
  [43] .debug_line_str   PROGBITS        0000000000000000 7a0d116 01fd8c 01  MS  0   0  1
  [44] .debug_aranges    PROGBITS        0000000000000000 7a2cea2 000390 00      0   0  1
  [45] .symtab           SYMTAB          0000000000000000 7a2d238 095298 18     47 12194  8
  [46] .shstrtab         STRTAB          0000000000000000 7ac24d0 00020d 00      0   0  1
  [47] .strtab           STRTAB          0000000000000000 7ac26dd 222aaa 00      0   0  1
Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
  L (link order), O (extra OS processing required), G (group), T (TLS),
  C (compressed), x (unknown), o (OS specific), E (exclude),
  D (mbind), l (large), p (processor specific)

The program is built with "-gline-tables-only" and "-fdebug-info-for-profiling" using llvm-19. These are all the accesses to the binary that create_gcov makes before crashing:

pread64(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\32\357\1\0\0\0\0"..., 64, 0) = 64
pread64(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 3072, 130961800) = 3072
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 672, 64) = 672
mmap(NULL, 1757, PROT_READ, MAP_SHARED, 3, 0x7ac2000) = 0x7851a40f3000
mmap(NULL, 8618262, PROT_READ, MAP_SHARED, 3, 0x71d5000) = 0x7851a27d5000
mmap(NULL, 1261265, PROT_READ, MAP_SHARED, 3, 0x2fbe000) = 0x7851a26a1000
mmap(NULL, 36757758, PROT_READ, MAP_SHARED, 3, 0x30f1000) = 0x7851a02f1000
mmap(NULL, 22073907, PROT_READ, MAP_SHARED, 3, 0x5a60000) = 0x78519ec60000
mmap(NULL, 2525443, PROT_READ, MAP_SHARED, 3, 0x6f6d000) = 0x78519e9f7000
mmap(NULL, 2712355, PROT_READ, MAP_SHARED, 3, 0x53ff000) = 0x78519e5ff000
mmap(NULL, 130722, PROT_READ, MAP_SHARED, 3, 0x7a0d000) = 0x7851a30ce000

It doesn't look like it even tried to access .debug_str_offsets.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions