[llvm-readelf] - Do not crash when relocation references a STT_SECTION symbol for the null section.

[grimar]

Summary

Currently, llvm-readelf crashes when there is a STT_SECTION symbol for the null section
and this symbol is used in a relocation.

This patch fixes the issue.

[jhenderson]

Nice catch, LGTM. You've now got me wondering how you found this issue!

[grimar]

In D81840#2095002, @jhenderson wrote:

Nice catch, LGTM. You've now got me wondering how you found this issue!

I was using AFL (https://lcamtuf.coredump.cx/afl/) to collect broken inputs causing crashes/hangs.
And now I am investigating and trying to fix what I've found.

llvm/test/tools/llvm-readobj/ELF/reloc-zero-name-or-value.test

 # Show that the value field is omitted if a symbol has no name or value, but is
 # printed if one is present. Test for both static and dynamic relocation
 # printing.
 
 # RUN: yaml2obj %s -o %t
 # RUN: llvm-readelf --relocations --dyn-relocations %t | FileCheck %s
 
-# CHECK:      Relocation section '.rela.text' at offset {{.*}} contains 3 entries:
+# CHECK:      Relocation section '.rela.text' at offset {{.*}} contains 4 entries:
 # CHECK-NEXT:     Offset             Info             Type               Symbol's Value  Symbol's Name + Addend
 # CHECK-NEXT: 0000000000000000  0000000000000000 R_X86_64_NONE                           1
 # CHECK-NEXT: 0000000000000000  0000000100000000 R_X86_64_NONE          0000000000000000 sym + 1
 # CHECK-NEXT: 0000000000000000  0000000200000000 R_X86_64_NONE          0000000000000123 456
+# CHECK-NEXT: 0000000000000000  0000000300000000 R_X86_64_NONE                           678
 
-# CHECK:      Relocation section '.rela.dyn' at offset {{.*}} contains 3 entries:
+# CHECK:      Relocation section '.rela.dyn' at offset {{.*}} contains 4 entries:
 # CHECK-NEXT:     Offset             Info             Type               Symbol's Value  Symbol's Name + Addend
 # CHECK-NEXT: 0000000000000000  0000000000000000 R_X86_64_NONE                           1
 # CHECK-NEXT: 0000000000000000  0000000100000000 R_X86_64_NONE          0000000000000000 sym + 1
 # CHECK-NEXT: 0000000000000000  0000000200000000 R_X86_64_NONE          0000000000000123 456
+# CHECK-NEXT: 0000000000000000  0000000300000000 R_X86_64_NONE                           678
 
-# CHECK:      'RELA' relocation section at offset {{.*}} contains 72 bytes:
+# CHECK:      'RELA' relocation section at offset {{.*}} contains 96 bytes:
 # CHECK-NEXT:     Offset             Info             Type               Symbol's Value  Symbol's Name + Addend
 # CHECK-NEXT: 0000000000000000  0000000000000000 R_X86_64_NONE                           1
 # CHECK-NEXT: 0000000000000000  0000000100000000 R_X86_64_NONE          0000000000000000 sym + 1
 # CHECK-NEXT: 0000000000000000  0000000200000000 R_X86_64_NONE          0000000000000123 456
+# CHECK-NEXT: 0000000000000000  0000000300000000 R_X86_64_NONE                           678
 
 --- !ELF
 FileHeader:
   Class:   ELFCLASS64
   Data:    ELFDATA2LSB
   Type:    ET_EXEC
   Machine: EM_X86_64
 Sections:
Relocations:
       - Offset: 0
         Type: R_X86_64_NONE
         Addend: 1
         Symbol: sym
       - Offset: 0
         Type: R_X86_64_NONE
         Addend: 0x456
         Symbol: 2
+      - Offset: 0
+        Addend: 0x678
+        Type:   R_X86_64_NONE
+        Symbol: 3
   - Name: .dynamic
     Type: SHT_DYNAMIC
     Flags: [SHF_ALLOC]
     Address: 0x1000
     AddressAlign: 0x1000
     Entries:
       - Tag: DT_RELA
         Value: 0x1100
       - Tag: DT_RELASZ
-        Value: 72
+        Value: 96
       - Tag: DT_RELAENT
         Value: 24
       - Tag: DT_NULL
         Value: 0
   - Name: .rela.dyn
     Type: SHT_RELA
     Flags: [SHF_ALLOC]
     Info: .text
     Address: 0x1100
     AddressAlign: 0x100
     Relocations:
       - Offset: 0
         Type: R_X86_64_NONE
         Addend: 1
       - Offset: 0
         Type: R_X86_64_NONE
         Addend: 1
         Symbol: sym
       - Offset: 0
         Type: R_X86_64_NONE
         Addend: 0x456
         Symbol: 2
+      - Offset: 0
+        Addend: 0x678
+        Type:   R_X86_64_NONE
+        Symbol: 3
 Symbols:
   - Name:    sym
     Value:   0
     Section: .text
     Binding: STB_GLOBAL
   - Value:   0x123
     Section: .text
     Binding: STB_GLOBAL
+  - Type:  STT_SECTION
+    Index: 0
 DynamicSymbols:
   - Name:    sym
     Value:   0
     Section: .text
     Binding: STB_GLOBAL
   - Value:   0x123
     Section: .text
     Binding: STB_GLOBAL
+  - Type:  STT_SECTION
+    Index: 0
 ProgramHeaders:
   - Type: PT_LOAD
     VAddr: 0x1000
     Sections:
       - Section: .dynamic
       - Section: .rela.dyn
   - Type: PT_DYNAMIC
     VAddr: 0x1000
     Sections:
       - Section: .dynamic

llvm/tools/llvm-readobj/ELFDumper.cpp

ELFDumper<ELFT>::getRelocationTarget(const Elf_Shdr *SymTab,
 
   // The st_name field of a STT_SECTION is usually 0 (empty string).
   // This code block returns the section name.
   if (Sym->getType() == ELF::STT_SECTION) {
     Expected<const Elf_Shdr *> SecOrErr =
         Obj->getSection(Sym, SymTab, ShndxTable);
     if (!SecOrErr)
       return SecOrErr.takeError();
+    // A section symbol describes the section at index 0.
+    if (*SecOrErr == nullptr)
+      return std::make_pair(Sym, "");
 
     Expected<StringRef> NameOrErr = Obj->getSectionName(*SecOrErr);
     if (!NameOrErr)
       return NameOrErr.takeError();
     return std::make_pair(Sym, NameOrErr->str());
   }
 
   Expected<StringRef> StrTableOrErr = Obj->getStringTableForSymtab(*SymTab);