arm-coff - ld - Segmentation fault for relocatable links

[john . smith]

Briefly, Assembling and linking --relocatable
        .text
        .set aa,0
        b  aa
causes me a Segmentation fault.


In more detail:

I am working with a conventional suse Linux.

I build a recent snapshot binutils-030823.tar.bz2 using

    ../binutils-030823/configure --target=arm-coff
                                 --prefix=${PREFIX}
    make
    make install

I create a file "a.s" containing

        .text
        .set aa,0
        b  aa

and assemble and link it with

   ${PREFIX}/bin/arm-coff-as a.s -o a.o 
   ${PREFIX}/bin/arm-coff-ld --relocatable  a.o -o b.o

The link stage causes a 
 Program received signal SIGSEGV, Segmentation fault.
 0x80619ef in bfd_free (ptr=0x80bab90) at ../../binutils-030823/bfd/libbfd.c:230
which is coming from a call to "free()" because 
of some heap corruption.
  
Limited investigations show:

With gdb, 

bash-2.05$ gdb local/bin/arm-coff-ld 
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-suse-linux"...
(gdb) run --relocatable b.o -o c.o
Starting program: /home/john/arm-seg-fault/local/bin/arm-coff-ld --relocatable 
a.o -o b.o

Program received signal SIGSEGV, Segmentation fault.
0x400951e9 in chunk_free () from /lib/libc.so.6
(gdb) where
#0  0x400951e9 in chunk_free () from /lib/libc.so.6
#1  0x40095064 in free () from /lib/libc.so.6
#2  0x8071289 in _bfd_coff_final_link (abfd=0x80aeef8, info=0x80ac000)
    at ../../binutils-030823/bfd/cofflink.c:924
#3  0x8058d91 in ldwrite () at ../../binutils-030823/ld/ldwrite.c:518
#4  0x8056cee in main (argc=5, argv=0xbffff86c)
    at ../../binutils-030823/ld/ldmain.c:474
#5  0x4003dc6f in __libc_start_main () from /lib/libc.so.6
(gdb) 


I think heap corruption is being caused by the code

      /* Place a mark in the sym_indices array (whose entries have
         been initialised to 0) for all of the symbols that are used
         in the relocation table.  This will then be picked up in the
         skip/don't-skip pass.  */
      for (; irel < irelend; irel++)
      {
           fprintf(stderr,
                   "Writing to finfo->sym_indices[ %d ]\n", 
                   irel->r_symndx ) ;
           finfo->sym_indices[ irel->r_symndx ] = -1;
      }

in cofflink.c. With the fprintf, I am getting the message

     Writing to finfo->sym_indices[ -1 ]

which is writing outside the limits of an array allocated on the heap.


John Smith