Misinterpreted FILE note for 32bit core files in readelf

Mark Wielaard mjw at redhat.com
Thu Apr 10 13:11:00 UTC 2014

On Thu, 2014-04-10 at 10:42 +0200, Markus Engel wrote:
> For 32bit core files, the FILE note is misinterpreted (tested in Version 
> 0.158 and git with readelf being a 64 and 32 bit binary), here is an 
> example output:
> CORE                  72  FILE
>      2 files:
>        00000000-080eb000 36d67b6ccd38000 135180288    gel/z/a.out
>      Not enough data in NT_FILE note.
> In readelf.c:handle_file_note, count and page_size are already 
> interpreted as 64 bit values, which advances ptr by 2*8 instead of 2*4.
> I traced this further to buf_read_ulong, where u has a size of 8, which 
> is given to convert, returning data + 8.
> Besides tracing these things I don't know how to fix it, mostly because 
> I don't know where exactly things go an unintended way :)

Actually it seems you pinpointed the cause exactly. The trouble is
indeed that buf_read_ulong passes 8 as size to convert while the size of
a long in the core file is 4. The attached patch fixes this and adds an
explicit testcase for a i686 core file. CCed Petr who originally added
the support to double check I didn't misinterpret the intention of
buf_read_ulong calling convert.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-readelf-convert-up-to-a-target-long-in-buf_read_ulon.patch
Type: text/x-patch
Size: 26747 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/elfutils-devel/attachments/20140410/31f218d4/attachment-0001.bin>

More information about the elfutils-devel mailing list