RELA entries are applied in order, and an R_X86_64_RELATIVE entry writes
relocbase + addend to its target (FreeBSD rtld's reloc_non_plt). Two
symbol-less RELATIVE entries for one target therefore leave the later
addend in place. Guest-module parsing and code analysis refused the pair
as overlapping; now the later entry replaces the earlier one.
PS5MC's sce_module/libc.prx (PPSA99420), the loader companion its build
generates, relocates 0x8058 twice: to 0x80e0, then to 0x82a0. It could
not be converted. Any other overlap, including a RELATIVE entry over a
symbol relocation, is still refused.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A DTPMOD64, DTPOFF64 or TPOFF64 against an STT_TLS symbol defined in the
module itself names the module's own TLS block as much as symbol 0
does, and #10730 rejects both forms for executables. Fail them as well
when the module's PT_TLS has p_memsz 0.
Standalone eh_frame_hdr row after the existing table overflow case:
encoding 0x31 (uleb128 | datarel) with a ten-byte ULEB128 whose last
byte overflows 64 bits, on segments at 0xFFFFFFFFFFFFF000. The reader
must throw "overflowing LEB128 value" from EhFrameReader::leb.
Co-Authored-By: Claude Haiku 5.5 <[email protected]>
CodeInstructionCollector took code pointers from DT_RELA and DT_JMPREL
but not from DT_RELR, which the pipeline has applied since #11463. A
function reachable only through a RELR pointer was therefore no entry
root, and a Windows TLS rewrite or GS trap could overwrite it without
the "would overwrite an executable entry point" refusal that the same
pointer as a RELA R_X86_64_RELATIVE triggers. Read the RELR table with
ReadRelrRelocations and record its slots like relative relocations.
The guest image reader accepted a module's TLS relocations against its
own block, by symbol 0 or by an unnamed zero-value section symbol,
whenever a PT_TLS header existed, also one with p_memsz 0. Linux output
kept such relocations, while Windows and macOS output rejected only
some of them later with different messages. Require a PT_TLS with a
nonzero p_memsz, as #10730 did for executables, so every target fails
these modules with "Invalid guest TLS relocation".
An executable or guest module with two PT_GNU_EH_FRAME headers converted
on every target: Linux output kept both headers and Windows output wrote
one .ehmeta section per header, while the unwinders at run time use a
single table per object. Reject the second header like a second
PT_DYNAMIC, in the pipeline for the executable and in the guest image
reader for modules.
The set-based control-flow walk inserted the addresses it found into the
caller's set from a destructor. Destructors are noexcept, so a failed
allocation there called std::terminate instead of reaching the
conversion's error handling as std::bad_alloc. The addresses are now
inserted after the walk returns, and before an exception from the walk
is rethrown, as the walk did before.
The new test arms a failing operator new from the progress callback
during a walk of 8,192 instructions and requires std::bad_alloc to reach
the caller; with the destructor it terminated.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The control-flow walk kept the reachable instructions of a code segment
in a std::unordered_set: every decoded instruction looked itself up,
was inserted, and was inserted into and erased from a visited set. The
instruction collector also handed the same growing set to each pass of
its root loop and walked all of it again every time.
The walk now marks each text offset in a byte map: reached, queued or
not seen. Queued marks are cleared when a walk ends, as the per-call
visited set was. ExtendControlFlowGraph takes a caller's map and
returns only the addresses that one walk added, in address order. The
collector keeps one map per segment and handles just those addresses.
BuildControlFlowGraph with a reachable set fills the map from the set
and inserts the new addresses in the order they were found.
Converting Goat Simulator 3's (PPSA04158) eboot.elf with
relinker --windows takes 27.56 s instead of 45.26 s (median of six
alternating runs on a Ryzen 9 5950X). Four more titles' eboot.elf
convert 35-54% faster, and every run produces the same output files.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Standalone EH table fixture after the unwind record loop: CIE zPLR with
LSDA encoding 0x4B (sdata4 funcrel), FDE augmentation 0xFFFFEFFF with
functionBase at the FDE begin 0x1000. The signed branch of
EhFrameReader::encoded must reject it with "unwind pointer address
overflowed".
Co-Authored-By: Claude Haiku 5.5 <[email protected]>
Standalone block after the main table overflow case: encoding 0x33
(udata4 + datarel), u32 0xFFFFFFFF displacements at the real table
entry offsets 16 and 20, data base 0xFFFFFFFFFFFFF000 so max - base
is 0xFFF, and an assert on the overflow RelinkerException message.
Co-Authored-By: Claude Haiku 5.5 <[email protected]>
Adrià