WhatTheElf — dynamic-loader fuzzing report
Findings
WhatTheElf runs deliberately malformed ELF files through 15 ELF backends — two dynamic loaders (glibc, musl), the qemu-user emulator, and a panel of inspection tools — looking for inputs that crash a backend rather than being cleanly accepted or rejected. The corpus is 73 hand-written structural cases plus 17 AFL++-found crash inputs, the latter curated with analyzed fault sites and grouped by the target each was found against (5 glibc, 11 musl, 1 llvm-objdump). The per-backend counts below are higher: they count every distinct input that crashes a backend in the full matrix — structural cases included, and several inputs crash more than one backend.
The headline is a clean split: only backends that act on the ELF structure crash — the ones that merely inspect it never do. Crashing: glibc's loader (16 inputs), musl's loader (13), qemu-user (38), and — alone among the inspection tools — llvm-objdump (3). The other 11 backends (readelf, llvm-readelf, eu-readelf, objdump, pyelftools, the `object` crate, file, scanelf, patchelf, eu-elflint, and the kernel's execve) handle all 90 inputs without crashing — they reject, warn, or leniently accept.
For the loaders there is no cheap validation gate: even glibc's --verify already mmaps the segments and walks the program headers, so it faults just like a full load. The faults span the whole loading pipeline — segment mapping and .bss zero-fill, symbol resolution, REL/RELA/RELR relocation, dependency loading, and TLS setup. qemu-user is the least hardened: its own loader crashes before the guest runs (host SIGSEGV/SIGBUS mapping wild addresses, a pgb_dynamic assertion, a GLib over-allocation abort) — a separate handful of inputs merely run the loaded garbage and fault in the guest, which is not a qemu bug. The broadest input, glibc_dyn_lsoname_oob — a PT_DYNAMIC whose entry walk runs off into unmapped memory — crashes glibc, musl, and llvm-objdump at once; most other inputs crash just one backend.
70 of the 1350 backend×case runs crashed. Loaders are exercised non-executing — glibc ld.so --preload (an exit-lib that stops after relocation) and ld-musl --list; llvm-objdump and qemu are fuzzed binary-only (AFL++ FRIDA mode). Crash catalogue, all unexpected outcomes, and the full backend×case matrix (click any cell for its stdout/stderr) follow.
Crashes
glibc — ld.so --preload exitfirst.so (full load)
| id | fault site | details |
|---|---|---|
| glibc_load_memsz_past_eof | _dl_map_segments memset (dl-map-segments.h:177) | A single PT_LOAD declares p_filesz=0x1800 and p_memsz=0x2000 in a file that is only 0xc0 bytes long. _dl_map_segments mmaps the segment from the (short) file, then zero-fills the gap between p_filesz and the end of the segment's last page with `memset((void *) zero, 0, zeropage - zero)` (dl-map-segments.h:177) to create the .bss. Because p_filesz points past the real end of the file, that page has no file backing and the store raises SIGBUS. The original fuzzer artifact (crashes/glibc_00_sig7.elf) used a 176-byte file with p_memsz≈0x6_0000_0002, giving the loader a 24 GiB maplength; the reproducer keeps the essential condition (filesz/memsz past EOF, memsz>filesz) minimal. |
| glibc_load_wild_vaddr_phdr | _dl_map_object_from_fd phdr rescan (dl-load.c:1342) | After mapping the segments, _dl_map_object_from_fd walks the program headers backward looking for PT_GNU_PROPERTY: `for (ph = &l->l_phdr[l->l_phnum]; ph != l->l_phdr; --ph) if (ph[-1].p_type == PT_GNU_PROPERTY)` (dl-load.c:1342). l->l_phdr is derived from the load layout / PT_PHDR. The first PT_LOAD here has a wild p_vaddr (0xb000_0000), p_filesz=0xb000_0000 and an absurd p_align (0x0600_0000_0200_0000), so the address glibc computes for l_phdr does not fall inside any mapped segment and dereferencing ph[-1] faults (SIGSEGV, or SIGBUS when the bad address lands on a file-backed page past EOF). The second PT_LOAD provides the offset/vaddr mismatch that drives l_phdr off the mapping. Reduced from crashes/glibc_01_sig11.elf (the corpus also held byte-variants glibc_02/03/05). |
| glibc_dyn_lsoname_oob | l_soname (ldsodefs.h:99, from dl-load.c:1429) | The object pairs a PT_LOAD (vaddr 0xb000_0000) with a PT_DYNAMIC at p_offset=0xe, vaddr 0xb000_0000 (overlapping the load) and p_filesz=0xffff_b000_0080_0000. _dl_map_object_from_fd reaches the 'did we just load libc.so?' check at dl-load.c:1429: `l_soname(l) != NULL && strcmp(l_soname(l), LIBC_SO)`. l_soname returns `D_PTR(l, l_info[DT_STRTAB]) + l_info[DT_SONAME]->d_un.d_val` (ldsodefs.h:99). elf_get_dynamic_info populated l_info[] by walking the dynamic array until DT_NULL, but the overlapping/oversized PT_DYNAMIC makes that walk run past the mapped bytes into adjacent memory; an entry there looks like DT_SONAME/DT_STRTAB pointing out of the mapping, so l_soname dereferences a wild l_info[] pointer and faults. |
| glibc_rtld_startup_strcmp | strcmp from dl_main start-up (rtld.c:1687) | A 203-byte object with a PT_LOAD plus a PT_INTERP whose fields are wildly out of range (p_filesz=0x3e00_0200_0000_0000, p_offset=0xb0_0000_0000_0000) and no valid PT_DYNAMIC. The instrumented build faults in strcmp (strcmp-sse2.S:160) with the caller attributed to dl_main at rtld.c:1687 — the start-up step that reconciles the loader's own libname with its soname. strcmp dereferences a string pointer that ends up out of range, but at -O2 the rtld start-up code is heavily inlined, so the exact field->pointer chain is not fully pinned down; this is recorded honestly as an observed SIGSEGV string-deref reached from that code rather than a clean reproducer. glibc_06 is a second byte-variant. |
| glibc_wild_vaddr_aslr | _dl_map_object_from_fd phdr rescan (dl-load.c:1342) | Two PT_LOADs with wild p_vaddr/p_offset, same family as glibc_load_wild_vaddr_phdr: the loader computes l_phdr outside the real mapping. Here whether the computed address hits an unmapped page depends on the randomized mmap base, so it SIGSEGVs under normal ASLR but runs clean under gdb (ASLR disabled). Kept as the raw artifact because the trigger is layout-dependent and not reproducible deterministically. |
musl — ld-musl --list
| id | fault site | details |
|---|---|---|
| musl_sysv_lookup_261 | sysv_lookup (dynlink.c:261) | Symbol lookup over a malformed SysV hash table: sysv_lookup walks for (i=hashtab[2+h%hashtab[0]]; i; i=hashtab[2+hashtab[0]+i]) and compares strings+syms[i].st_name (dynlink.c:261). Bad DT_HASH/DT_SYMTAB/DT_STRTAB drive the chain indices out of bounds. |
| musl_reloc_all_430 | reloc_all (dynlink.c:430) | While relocating the object, do_relocs dereferences the symbol/string tables built from a malformed dynamic section: sym = syms + sym_index; name = strings + sym->st_name (dynlink.c:430). Bad DT_SYMTAB/DT_STRTAB make these pointers land outside the mapping; both SIGSEGV and SIGBUS (file-backed page past EOF) were observed here. |
| musl_load_direct_deps_1067 | load_direct_deps (dynlink.c:1067) | Resolving DT_NEEDED dependencies: each dependency name is strtab + d_val, then load_library(name,...) dereferences it at 'if (!*name)' (dynlink.c:1067). A wild DT_STRTAB makes the name pointer point outside the image, so the first byte read faults. |
| musl_do_relr_relocs_570 | do_relr_relocs (dynlink.c:570) | Processing DT_RELR relative relocations: reloc_addr = laddr(dso, relr[0]); *reloc_addr++ += base (dynlink.c:570). A crafted RELR table decodes to addresses outside the mapping, so the relocation write hits unmapped memory (SIGSEGV) or a file-backed page past EOF (SIGBUS) - both signals were observed at this site. |
| musl___dls3_1414 | __dls3 (dynlink.c:1414) | __dls3 drives loading + relocation of the crafted object; the fault occurs in the relocation pass it invokes (reloc_all/do_relocs at dynlink.c:1414) over malformed dynamic tables. |
| musl_memset_847 | memset (dynlink.c:847) | map_library zeroes the .bss tail of a PT_LOAD: brk=base+p_vaddr+p_filesz; memset((void*)brk, 0, pgbrk-brk & PAGE_SIZE-1) (dynlink.c:847). When p_filesz runs past the real end of the file the page being zeroed has no file backing, so the store raises SIGBUS. musl analogue of the glibc _dl_map_segments zero-fill crash. |
| musl_do_relocs_473 | do_relocs (dynlink.c:473) | Applying a REL_GOT/REL_PLT relocation: *reloc_addr = sym_val + addend (dynlink.c:473). reloc_addr is laddr(dso, r_offset) from a crafted relocation whose offset lands outside the mapping, so the write faults. |
| musl_do_relocs_486 | do_relocs (dynlink.c:486) | Applying a REL_COPY relocation: memcpy(reloc_addr, (void*)sym_val, sym->st_size) (dynlink.c:486). Crafted symbol/relocation values give a wild destination, source, or size, so the copy faults. |
| musl_do_relocs_345 | do_relocs (dynlink.c:345) | do_relocs resolves a relocation's symbol via the (malformed) DT_SYMTAB/DT_STRTAB and looks it up with find_sym (dynlink.c:345); bad tables drive the lookup out of bounds. |
| musl___dls3_852 | __dls3 (dynlink.c:852) | After mapping segments, map_library scans the dynamic array for DT_TEXTREL: for (i=0; ((size_t*)(base+dyn))[i]; i+=2) (dynlink.c:852). A bogus PT_DYNAMIC vaddr makes base+dyn point outside the mapping, so the scan reads unmapped memory. |
| musl_memcpy_66 | __copy_tls memcpy (__init_tls.c:66) | Setting up TLS, __copy_tls copies each module's TLS image: memcpy(mem - p->offset, p->image, p->len) (__init_tls.c:66). A crafted PT_TLS gives a wild offset/image/len, so the copy reads or writes outside the allocated TLS block. |
llvm-objdump — llvm-objdump -p (FRIDA-mode binary fuzzing)
| id | fault site | details |
|---|---|---|
| objdump_so_sigsegv | LLVM object parser (llvm-objdump -p) | Mutating a valid shared object and parsing it with `llvm-objdump -p` SIGSEGVs inside LLVM's object-file parsing — LLVM's crash handler fires ("PLEASE submit a bug report to the LLVM project"). Found by AFL++ FRIDA-mode binary-only fuzzing of the installed tool; the distribution binary is stripped so the exact LLVM function is not pinned down. Confirmed to reproduce on stock llvm-objdump 18. |
Unexpected outcomes
70 backend×case outcomes where a backend crashed, hung, or errored (everything else was a clean accept/reject). Loaders faulting are the headline; tool crashes (e.g. llvm-objdump) and qemu-user dying in its own pre-launch loader are surfaced here too. Red = crash.
| backend | n | cases (hover for the finding) |
|---|---|---|
| ld-glibc | 16 | filesz_gt_memsz glibc_dyn_lsoname_oob glibc_load_memsz_past_eof glibc_load_wild_vaddr_phdr glibc_rtld_startup_strcmp glibc_wild_vaddr_aslr interp_empty_string interp_filesz_zero interp_no_nul interp_offset_oob load_align_non_power_two load_offset_oob load_vaddr_wraparound objdump_so_sigsegv phdr_misaligned symtab_shlink_oob |
| ld-musl | 13 | dynamic_relent_zero glibc_dyn_lsoname_oob musl___dls3_1414 musl___dls3_852 musl_do_relocs_345 musl_do_relocs_473 musl_do_relocs_486 musl_do_relr_relocs_570 musl_load_direct_deps_1067 musl_memcpy_66 musl_memset_847 musl_reloc_all_430 musl_sysv_lookup_261 |
| llvm-objdump | 3 | glibc_dyn_lsoname_oob musl___dls3_852 objdump_so_sigsegv |
| qemu-x86_64 | 38 | bad_file_version bad_shentsize_large bad_shentsize_short glibc_load_memsz_past_eof glibc_rtld_startup_strcmp interp_filesz_zero interp_section_missing interp_section_no_nul interp_shname_oob interp_shoffset_oob interp_shsize_zero load_offset_oob note_desc_oob note_header_short_fields note_name_oob note_truncated_header phdr_overlaps_ehdr phnum_zero pt_phdr_misaligned rela_shlink_not_symtab sh_info_oob_info_link shdr_overlaps_ehdr shdr_table_truncated shnum_huge_oob shoff_oob shstrndx_not_strtab shstrndx_oob symtab_entsize_too_large symtab_entsize_zero symtab_shinfo_too_large symtab_shlink_not_strtab symtab_shlink_oob symtab_size_not_multiple verdef_bad_aux_offset verdef_truncated_header verneed_bad_aux_offset verneed_truncated_header versym_size_odd |
Backend results
Hover a cell for the backend's message; click it for the full finding below.
Click a cell to see backend · case · status · finding.
| case | eu-elflint | eu-readelf | file | kernel-execve | ld-glibc | ld-musl | llvm-objdump | llvm-readelf | objdump | object-readobj | patchelf | pyelftools | qemu-x86_64 | readelf | scanelf |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| bad_class_elf32 | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-error | graceful-error | graceful-error | graceful-warning | accepted |
| bad_data_big_endian | graceful-error | graceful-error | accepted | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-error | accepted | accepted | graceful-error | accepted | graceful-error | graceful-warning | accepted |
| bad_ehsize_short | graceful-error | graceful-error | accepted | graceful-error | graceful-error | graceful-error | accepted | accepted | accepted | accepted | graceful-error | accepted | graceful-error | graceful-warning | accepted |
| bad_file_type | graceful-error | graceful-error | accepted | graceful-error | graceful-error | graceful-error | accepted | accepted | accepted | accepted | graceful-error | accepted | graceful-error | graceful-warning | accepted |
| bad_file_version | graceful-error | graceful-error | accepted | graceful-error | graceful-error | graceful-error | accepted | accepted | accepted | accepted | graceful-error | accepted | crash | graceful-warning | accepted |
| bad_ident_version | graceful-error | graceful-error | accepted | graceful-error | graceful-error | graceful-error | accepted | accepted | graceful-error | graceful-warning | graceful-error | accepted | graceful-error | graceful-warning | graceful-warning |
| bad_magic_zero | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | accepted | accepted | graceful-error | accepted | graceful-error | graceful-error | graceful-error | graceful-error | accepted |
| bad_phentsize_large | graceful-error | accepted | graceful-error | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-error | accepted | graceful-warning | graceful-error | accepted | graceful-error | graceful-warning | graceful-warning |
| bad_phentsize_short | graceful-error | accepted | graceful-error | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-error | accepted | graceful-warning | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-warning |
| bad_shentsize_large | graceful-error | accepted | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-error | accepted | crash | graceful-warning | graceful-warning |
| bad_shentsize_short | graceful-error | accepted | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | graceful-warning |
| dynamic_gnu_hash_bad_chain_ptr | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | graceful-warning | graceful-warning | graceful-error | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| dynamic_gnu_hash_oob | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | accepted | graceful-warning | graceful-error | accepted | graceful-error | accepted | graceful-error | graceful-warning | accepted |
| dynamic_gnu_hash_zero_bloom_words | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | accepted | graceful-warning | graceful-error | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| dynamic_gnu_hash_zero_buckets | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | accepted | graceful-warning | graceful-error | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| dynamic_hash_oob | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | accepted | graceful-warning | graceful-error | accepted | graceful-error | accepted | graceful-error | graceful-warning | accepted |
| dynamic_hash_self_loop | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-warning | accepted | accepted | graceful-error | accepted | graceful-error | graceful-warning | accepted |
| dynamic_null_missing | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | graceful-warning | accepted | graceful-error | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| dynamic_relent_zero | graceful-error | accepted | accepted | graceful-error | graceful-error | crash | accepted | accepted | graceful-error | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| dynamic_relr_oob | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | accepted | graceful-warning | graceful-error | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| dynamic_relr_without_size | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | accepted | accepted | graceful-error | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| dynamic_relrent_wrong | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | accepted | accepted | graceful-error | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| dynamic_strtab_oob | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | accepted | graceful-warning | graceful-error | accepted | graceful-error | accepted | graceful-error | graceful-warning | accepted |
| dynamic_strtab_size_oob | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | accepted | graceful-warning | graceful-error | accepted | graceful-error | accepted | graceful-error | graceful-warning | accepted |
| dynamic_strtab_without_strsz | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | accepted | accepted | graceful-error | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| dynamic_syment_zero | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | accepted | graceful-warning | graceful-error | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| dynamic_symtab_without_hash | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | accepted | accepted | graceful-error | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| dynamic_symtab_without_syment | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | accepted | accepted | graceful-error | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| dynamic_verneed_without_count | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | accepted | accepted | graceful-error | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| dynamic_versym_oob | graceful-error | accepted | accepted | graceful-error | graceful-error | accepted | accepted | graceful-warning | accepted | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| filesz_gt_memsz | graceful-error | accepted | accepted | graceful-error | crash | graceful-error | accepted | accepted | accepted | accepted | graceful-error | accepted | graceful-error | graceful-warning | accepted |
| glibc_dyn_lsoname_oob | graceful-error | accepted | graceful-error | graceful-error | crash | crash | crash | graceful-warning | graceful-error | graceful-warning | graceful-error | accepted | graceful-error | graceful-warning | graceful-warning |
| glibc_load_memsz_past_eof | accepted | accepted | accepted | graceful-error | crash | graceful-error | accepted | accepted | accepted | accepted | graceful-error | accepted | crash | accepted | accepted |
| glibc_load_wild_vaddr_phdr | graceful-error | accepted | accepted | graceful-error | crash | graceful-error | accepted | accepted | graceful-warning | accepted | graceful-error | accepted | graceful-error | graceful-warning | accepted |
| glibc_rtld_startup_strcmp | graceful-error | accepted | graceful-error | graceful-error | crash | graceful-error | accepted | graceful-warning | graceful-warning | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | accepted |
| glibc_wild_vaddr_aslr | graceful-error | accepted | accepted | graceful-error | crash | graceful-error | accepted | accepted | graceful-warning | accepted | graceful-error | accepted | graceful-error | graceful-warning | accepted |
| interp_empty_string | accepted | accepted | graceful-error | graceful-error | crash | graceful-error | accepted | accepted | accepted | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| interp_filesz_zero | accepted | accepted | graceful-error | graceful-error | crash | graceful-error | accepted | accepted | accepted | graceful-warning | graceful-error | accepted | crash | graceful-warning | accepted |
| interp_no_nul | accepted | accepted | accepted | graceful-error | crash | graceful-error | accepted | graceful-warning | accepted | graceful-warning | graceful-error | graceful-error | graceful-error | accepted | accepted |
| interp_offset_oob | accepted | accepted | graceful-error | graceful-error | crash | graceful-error | accepted | graceful-warning | accepted | graceful-warning | graceful-error | graceful-error | graceful-error | graceful-warning | accepted |
| interp_section_missing | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | accepted | accepted | accepted | graceful-error | accepted | crash | graceful-warning | accepted |
| interp_section_no_nul | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | accepted | accepted | accepted | accepted | accepted | crash | graceful-warning | accepted |
| interp_shname_oob | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | graceful-error | graceful-error | graceful-warning | graceful-error | accepted | crash | graceful-warning | accepted |
| interp_shoffset_oob | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | accepted | graceful-warning | accepted | graceful-error | accepted | crash | graceful-warning | accepted |
| interp_shsize_zero | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | accepted | accepted | accepted | accepted | accepted | crash | graceful-warning | accepted |
| load_align_non_power_two | graceful-error | accepted | accepted | graceful-error | crash | graceful-error | accepted | accepted | graceful-warning | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| load_offset_oob | accepted | accepted | accepted | graceful-error | crash | graceful-error | accepted | accepted | accepted | accepted | graceful-error | accepted | crash | accepted | accepted |
| load_vaddr_wraparound | accepted | accepted | accepted | graceful-error | crash | graceful-error | accepted | accepted | accepted | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| musl___dls3_1414 | graceful-error | graceful-error | accepted | graceful-error | graceful-error | crash | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-error | graceful-error | graceful-error | accepted | graceful-warning |
| musl___dls3_852 | graceful-error | accepted | graceful-error | graceful-error | graceful-error | crash | crash | graceful-warning | graceful-warning | graceful-warning | graceful-error | accepted | graceful-error | graceful-warning | accepted |
| musl_do_relocs_345 | graceful-error | accepted | accepted | graceful-error | graceful-error | crash | graceful-warning | graceful-warning | graceful-error | graceful-warning | graceful-error | accepted | graceful-error | accepted | accepted |
| musl_do_relocs_473 | graceful-error | accepted | accepted | graceful-error | graceful-error | crash | graceful-warning | graceful-warning | accepted | graceful-warning | graceful-error | accepted | graceful-error | accepted | accepted |
| musl_do_relocs_486 | graceful-error | accepted | graceful-error | graceful-error | graceful-error | crash | graceful-warning | graceful-warning | graceful-error | graceful-warning | graceful-error | accepted | graceful-error | graceful-warning | graceful-warning |
| musl_do_relr_relocs_570 | graceful-error | graceful-error | accepted | graceful-error | graceful-error | crash | graceful-warning | graceful-warning | graceful-error | graceful-warning | graceful-error | accepted | graceful-error | accepted | graceful-warning |
| musl_load_direct_deps_1067 | graceful-error | accepted | accepted | graceful-error | graceful-error | crash | graceful-warning | graceful-warning | graceful-error | accepted | graceful-error | accepted | graceful-error | graceful-warning | accepted |
| musl_memcpy_66 | graceful-error | accepted | accepted | graceful-error | graceful-error | crash | graceful-warning | graceful-warning | graceful-warning | graceful-warning | graceful-error | accepted | graceful-error | accepted | accepted |
| musl_memset_847 | graceful-error | accepted | graceful-error | graceful-error | graceful-error | crash | graceful-warning | graceful-error | graceful-warning | graceful-warning | graceful-error | accepted | graceful-error | graceful-warning | graceful-warning |
| musl_reloc_all_430 | graceful-error | accepted | accepted | graceful-error | graceful-error | crash | graceful-warning | graceful-warning | accepted | graceful-warning | graceful-error | accepted | graceful-error | accepted | accepted |
| musl_sysv_lookup_261 | graceful-error | accepted | accepted | graceful-error | graceful-error | crash | graceful-warning | graceful-warning | graceful-warning | graceful-warning | graceful-error | accepted | graceful-error | accepted | accepted |
| note_desc_oob | graceful-error | graceful-error | accepted | graceful-error | graceful-error | graceful-error | accepted | graceful-warning | accepted | graceful-warning | graceful-error | accepted | crash | graceful-warning | accepted |
| note_header_short_fields | graceful-error | graceful-error | accepted | graceful-error | graceful-error | graceful-error | accepted | graceful-warning | accepted | graceful-warning | graceful-error | accepted | crash | graceful-warning | accepted |
| note_name_oob | graceful-error | graceful-error | accepted | graceful-error | graceful-error | graceful-error | accepted | graceful-warning | accepted | graceful-warning | graceful-error | accepted | crash | graceful-warning | accepted |
| note_truncated_header | graceful-error | graceful-error | accepted | graceful-error | graceful-error | graceful-error | accepted | graceful-warning | accepted | graceful-warning | graceful-error | accepted | crash | graceful-warning | accepted |
| objdump_so_sigsegv | graceful-error | accepted | accepted | graceful-error | crash | accepted | crash | graceful-warning | graceful-warning | graceful-warning | graceful-error | accepted | graceful-error | accepted | accepted |
| phdr_misaligned | accepted | accepted | accepted | graceful-error | crash | graceful-error | accepted | accepted | accepted | accepted | graceful-error | accepted | graceful-error | accepted | accepted |
| phdr_overlaps_ehdr | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | accepted | accepted | accepted | graceful-error | accepted | crash | accepted | accepted |
| phdr_table_truncated | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-error | graceful-error | graceful-warning | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-warning |
| phnum_huge_oob | graceful-error | graceful-error | accepted | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-error | graceful-error | graceful-warning | graceful-error | accepted | graceful-error | graceful-warning | graceful-warning |
| phnum_zero | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | accepted | accepted | accepted | graceful-error | accepted | crash | graceful-warning | accepted |
| phoff_oob | graceful-error | graceful-error | accepted | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-error | graceful-error | graceful-warning | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-warning |
| pt_phdr_misaligned | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | accepted | accepted | accepted | graceful-error | accepted | crash | graceful-warning | accepted |
| rela_shlink_not_symtab | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | accepted | graceful-warning | graceful-warning | graceful-error | accepted | crash | graceful-warning | accepted |
| sh_info_oob_info_link | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | accepted | graceful-error | graceful-warning | graceful-error | accepted | crash | graceful-warning | accepted |
| shdr_overlaps_ehdr | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | graceful-error | graceful-error | graceful-warning | graceful-error | accepted | crash | graceful-warning | accepted |
| shdr_table_truncated | graceful-error | accepted | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | graceful-warning |
| shnum_huge_oob | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | graceful-warning |
| shoff_oob | graceful-error | graceful-error | accepted | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | graceful-warning |
| shstrndx_not_strtab | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | graceful-error | graceful-warning | accepted | graceful-error | graceful-error | crash | graceful-warning | accepted |
| shstrndx_oob | graceful-error | accepted | graceful-error | graceful-error | graceful-error | graceful-error | accepted | graceful-error | graceful-warning | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | accepted |
| symtab_entsize_too_large | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | graceful-warning | graceful-warning | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | accepted |
| symtab_entsize_zero | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | graceful-warning | graceful-warning | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | accepted |
| symtab_shinfo_too_large | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | accepted | graceful-warning | graceful-warning | graceful-error | accepted | crash | graceful-warning | accepted |
| symtab_shlink_not_strtab | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | graceful-warning | graceful-warning | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | accepted |
| symtab_shlink_oob | graceful-error | graceful-error | accepted | graceful-error | crash | graceful-error | accepted | graceful-error | graceful-error | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | accepted |
| symtab_size_not_multiple | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | graceful-warning | graceful-warning | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | accepted |
| verdef_bad_aux_offset | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | graceful-warning | graceful-warning | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | accepted |
| verdef_truncated_header | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | graceful-warning | graceful-warning | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | accepted |
| verneed_bad_aux_offset | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-warning | graceful-warning | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | accepted |
| verneed_truncated_header | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | graceful-warning | graceful-warning | graceful-warning | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | accepted |
| versym_size_odd | graceful-error | accepted | accepted | graceful-error | graceful-error | graceful-error | accepted | graceful-warning | graceful-error | graceful-warning | graceful-error | graceful-error | crash | graceful-warning | accepted |
Structural cases
| id | tags | summary |
|---|---|---|
| bad_magic_zero | encoding | ELF magic bytes are all zero. |
| bad_class_elf32 | encoding, consistency | ELF ident class says ELF32 while the rest of the file is ELF64-shaped. |
| bad_data_big_endian | encoding, consistency | ELF ident data says big-endian while fields are written little-endian. |
| bad_ident_version | encoding | ELF ident version is not EV_CURRENT. |
| bad_file_version | encoding | ELF file header version is not EV_CURRENT. |
| bad_ehsize_short | consistency, cardinality | ELF header declares a size smaller than the actual ELF64 header. |
| bad_phentsize_short | consistency, cardinality | Program-header entry size is smaller than the ELF64 program-header size. |
| bad_phentsize_large | consistency, cardinality | Program-header entry size disagrees with the ELF64 program-header size. |
| bad_shentsize_short | consistency, cardinality | Section-header entry size is smaller than the ELF64 section-header size. |
| bad_shentsize_large | consistency, cardinality | Section-header entry size disagrees with the ELF64 section-header size. |
| bad_file_type | encoding | ELF file type is outside the normal object-file type range. |
| phnum_zero | existence, cardinality | ELF executable declares zero program headers. |
| phnum_huge_oob | bounds, cardinality | Program-header count is huge while the file contains only one entry. |
| phoff_oob | bounds | Program-header table offset points beyond the file. |
| phdr_table_truncated | bounds, cardinality | Program-header count asks for two entries but only one is present. |
| phdr_overlaps_ehdr | non-overlap, containment | Program-header table range starts inside the ELF header. |
| phdr_misaligned | alignment | Program-header table starts at an unaligned file offset. |
| pt_phdr_misaligned | alignment | Special PT_PHDR entry is itself placed at a misaligned file offset. |
| filesz_gt_memsz | conjugate | Loadable segment has p_filesz greater than p_memsz. |
| load_offset_oob | bounds, containment | Loadable segment file range points beyond the file. |
| load_vaddr_wraparound | bounds, conjugate | Loadable segment virtual-address arithmetic wraps around u64. |
| load_align_non_power_two | alignment, encoding | Loadable segment alignment is neither zero nor a power of two. |
| interp_filesz_zero | existence, cardinality | PT_INTERP segment has zero file size. |
| interp_empty_string | existence, encoding | PT_INTERP contains only a NUL byte, yielding an empty interpreter path. |
| interp_offset_oob | bounds, containment | PT_INTERP segment points beyond the file. |
| interp_no_nul | encoding, consistency | PT_INTERP segment contains a non-empty interpreter name without a trailing NUL. |
| shoff_oob | bounds | Section-header table offset points beyond the file. |
| shnum_huge_oob | bounds, cardinality | Section-header count is huge while the file contains only one entry. |
| shdr_table_truncated | bounds, cardinality | Section-header count asks for two entries but only one is present. |
| shdr_overlaps_ehdr | non-overlap, containment | Section-header table range starts inside the ELF header. |
| shstrndx_oob | bounds | Section-name string-table index points outside the section table. |
| shstrndx_not_strtab | conjugate, encoding | Section-name string-table index points at a non-string-table section. |
| sh_info_oob_info_link | bounds | Section with SHF_INFO_LINK has an out-of-range sh_info reference. |
| symtab_shlink_oob | bounds | Symbol table sh_link points outside the section table. |
| symtab_shlink_not_strtab | conjugate, encoding | Symbol table sh_link points at another symbol table instead of a string table. |
| symtab_entsize_zero | conjugate, cardinality | Symbol table has non-zero size but zero entry size. |
| symtab_entsize_too_large | conjugate, cardinality | Symbol table entry size is larger than the table size. |
| symtab_size_not_multiple | conjugate, cardinality | Symbol table size is not a multiple of its entry size. |
| symtab_shinfo_too_large | bounds, conjugate | Symbol table sh_info declares more local symbols than entries. |
| rela_shlink_not_symtab | conjugate, encoding | Rela relocation section sh_link points to a string table instead of a symbol table. |
| interp_section_missing | existence | Section table has names but no .interp section. |
| interp_shname_oob | bounds | .interp-like section has a name offset outside .shstrtab. |
| interp_shoffset_oob | bounds, containment | .interp section file range points beyond the file. |
| interp_shsize_zero | existence, cardinality | .interp section exists but has zero size. |
| interp_section_no_nul | encoding, consistency | .interp section content is not NUL-terminated. |
| dynamic_strtab_without_strsz | coexistence | Dynamic table has DT_STRTAB but no DT_STRSZ. |
| dynamic_symtab_without_syment | coexistence | Dynamic table has DT_SYMTAB but no DT_SYMENT. |
| dynamic_symtab_without_hash | coexistence | Dynamic table has DT_SYMTAB and DT_SYMENT but no SysV or GNU hash table. |
| dynamic_syment_zero | conjugate, cardinality | Dynamic table declares a symbol table with zero DT_SYMENT. |
| dynamic_strtab_oob | bounds, containment | DT_STRTAB virtual address is outside every loadable segment. |
| dynamic_strtab_size_oob | bounds, containment | DT_STRTAB starts in a loadable segment but DT_STRSZ extends beyond it. |
| dynamic_hash_oob | bounds, containment | DT_HASH points outside every loadable segment. |
| dynamic_hash_self_loop | consistency, bounds | SysV hash table chain points back to itself. |
| dynamic_gnu_hash_oob | bounds, containment | DT_GNU_HASH points outside every loadable segment. |
| dynamic_gnu_hash_zero_buckets | cardinality, consistency | GNU hash table header declares zero buckets. |
| dynamic_gnu_hash_zero_bloom_words | cardinality, consistency | GNU hash table header declares zero bloom filter words. |
| dynamic_gnu_hash_bad_chain_ptr | bounds, consistency | GNU hash bucket points below symoffset, making the chain pointer underflow. |
| dynamic_verneed_without_count | coexistence | Dynamic table has DT_VERNEED but no DT_VERNEEDNUM. |
| dynamic_versym_oob | bounds, containment | Dynamic version-symbol table points outside every loadable segment. |
| dynamic_relr_without_size | coexistence | Dynamic table has DT_RELR but no DT_RELRSZ. |
| dynamic_relrent_wrong | conjugate, encoding | Dynamic table declares RELR entries with a non-word entry size. |
| dynamic_relr_oob | bounds, containment | DT_RELR/DT_RELRSZ describes a RELR table outside every loadable segment. |
| dynamic_relent_zero | conjugate, cardinality | Dynamic table declares a REL relocation table with zero DT_RELENT. |
| dynamic_null_missing | existence, coexistence | Dynamic table has entries but no DT_NULL terminator. |
| note_truncated_header | bounds, cardinality | PT_NOTE segment is shorter than one note header. |
| note_header_short_fields | bounds, cardinality | PT_NOTE segment stops in the middle of the note type field. |
| note_name_oob | bounds, containment | Note header namesz extends beyond the PT_NOTE segment. |
| note_desc_oob | bounds, containment | Note header descsz extends beyond the PT_NOTE segment. |
| verdef_truncated_header | bounds, cardinality | GNU version-definition section is shorter than one Verdef record. |
| verdef_bad_aux_offset | bounds, containment | GNU version-definition entry points its auxiliary record outside the section. |
| verneed_truncated_header | bounds, cardinality | GNU version-need section is shorter than one Verneed record. |
| verneed_bad_aux_offset | bounds, containment | GNU version-need entry points its auxiliary record outside the section. |
| versym_size_odd | cardinality, conjugate | GNU version-symbol section size is not a multiple of a Versym entry. |