Skip to content

Fix iter_notes crash on GNU build-ID notes in core dumps - #665

Open
apoorva-01 wants to merge 1 commit into
eliben:mainfrom
apoorva-01:fix-gnu-build-id-note-in-core
Open

Fix iter_notes crash on GNU build-ID notes in core dumps#665
apoorva-01 wants to merge 1 commit into
eliben:mainfrom
apoorva-01:fix-gnu-build-id-note-in-core

Conversation

@apoorva-01

Copy link
Copy Markdown

Core dumps can carry a GNU build-ID note (type 3, name GNU). But in an ET_CORE file type 3 means NT_PRPSINFO, so iter_notes() reads the short build ID as a 124-byte prpsinfo struct and blows up with ELFParseError. readelf handles the same file fine.

Fix: if a note is named GNU in a core file, resolve its type against the generic GNU enum instead. Only touches core files.

Open question for you: the broader fix is to decode n_type as a raw int and pick the enum from n_name in iter_notes. More general, but it changes the shared struct, so I kept this contained. Your call.

Test builds a tiny ET_CORE ELF with a build-ID note. Fails before, passes after. Suite green, ruff clean.

Closes #656.

In an ET_CORE file type 3 decodes as NT_PRPSINFO, so a GNU build-ID note
(type 3, name 'GNU') got parsed as a 124-byte prpsinfo struct and raised
ELFParseError. Re-resolve GNU-named notes against the generic note enum so
type 3 stays NT_GNU_BUILD_ID.
@eliben
eliben requested a review from sevaa July 8, 2026 15:40

@sevaa sevaa left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Never had to deal with coredumps myself, but the logic looks sensible. We don't have a lot of coredumps in the corpus though, do we?

@apoorva-01

Copy link
Copy Markdown
Author

Yeah, just the three core_linux* fixtures. That's why I built the ET_CORE file inline in the test instead of committing another binary. Easy to point at a real coredump too if you'd rather have one in the corpus.

@eliben

eliben commented Jul 9, 2026

Copy link
Copy Markdown
Owner

While the logic looks ok, the whole issue feels extremely niche to me. It would be nicer to see a more general solution here, as well as a couple of representative core files committed in that actual comparison tests could run on.

@apoorva-01

apoorva-01 commented Jul 11, 2026

Copy link
Copy Markdown
Author

I'll switch to the general version: resolve the type from n_name (GNU notes use GNU types, CORE notes use core types) instead of keying off e_type. That fixes the reverse case too.

For fixtures: what do you prefer?
I can generate a small real coredump with a build-id note and wire it into the readelf comparison tests, or use a specific core if you have one in mind

@eliben

eliben commented Jul 11, 2026

Copy link
Copy Markdown
Owner

Generating a small real coredump is fine - but please include clear instructions on how to reproduce it (e.g. a simple C file, the gcc command to create the binary, and the execution steps).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Crash in iter_notes() when parsing NT_GNU_BUILD_ID notes inside ET_CORE files (type-3 note collision)

3 participants