Fix two PHT-relocation correctness bugs (#643, #639)

[domenkozar]

Fixes two independent correctness bugs in the program-header-table (PHT) relocation logic, both of which currently block bumping patchelf in nixpkgs.

#643 — in-place PHT growth assumes the PHT is right after the ELF header

rewriteSectionsLibrary decides whether a section collides with the grown PHT by comparing the section's file offset against phtSize, which only makes sense when the PHT sits at its canonical location right after the ELF header. When the PHT is elsewhere in the file — e.g. the OpenSSL libcrypto.so.1.1 shipped in many manylinux wheels, whose PHT sits near the end — that check looks in the wrong place, the PHT is wrongly kept in place, and patching aborts with cannot find section '.hash'.

The fix detects the non-canonical PHT location up front (e_phoff != sizeof(Elf_Ehdr)) and relocates the PHT to the end of the file in that case.

Verified on the real libcrypto.so.1.1 from the issue: before the fix patchelf errors cannot find section '.hash'; after, --set-rpath succeeds and the result is a structurally valid ELF.

A regression test is included (tests/pht-relocation.sh). The fixture is that real libcrypto.so.1.1, stripped and xz-compressed (decompressed at test time, skipped if xz is unavailable — mirroring the existing short-first-segment.gz fixture). I could not reproduce the corruption with a minimally-synthesized binary — it depends on the real multi-segment / many-section layout — so the fixture is larger (~730 KB) than the existing ones. Happy to swap it for a smaller trigger if anyone knows of one.

#639 — .dynamic fixup never updated DT_INIT / DT_FINI / DT_*_ARRAY

The .dynamic fixup loop rewrites DT_STRTAB/DT_SYMTAB/DT_HASH/… to the new addresses of their sections, but never updated DT_INIT, DT_FINI, DT_INIT_ARRAY, DT_FINI_ARRAY or DT_PREINIT_ARRAY. When growing the PHT relocates .init (common with lld's tight layout), the loader then jumps to a stale DT_INIT and the process SIGSEGVs, typically on dlopen. The fix updates those entries from the relocated section addresses, like the others.

This fix is correct by construction and the full test suite stays green, but I was not able to synthesize the exact lld layout that relocates .init, so it has no dedicated regression test. Guidance on producing such a fixture welcome.

---

These are independent; I'm happy to split into two PRs if that's easier to review/merge.

Assisted-by: Claude Code (Claude Opus 4.8)

[Fedr]

Confirming this addresses a real downstream case — I filed #639 after hitting it while packaging MeshLib's Python bindings (an lld-built libpybind11nonlimitedapi_*.so run through patchelf --set-rpath by linuxdeploy).

I recovered the actual triggering binary from one of our daily builds (clang/lld 21). It has exactly the tight layout that's hard to synthesize — .init packed immediately after an 8-entry PHT:

PHDR                       off 0x40   (8 entries, ends at 0x200)
[ 1] .note.gnu.build-id    0x200
[ 2] .init                 0x224      <- right after the PHT
[ 3] .plt                  0x240
[ 4] .text                 0xff0
DT_INIT = 0x224

Reproduction with patchelf 0.18.0 (the released line linuxdeploy bundles) — appending any path to the existing RUNPATH is enough:

$ patchelf --set-rpath '<existing>:$ORIGIN/x' shim.so
$ readelf -SW shim.so | grep ' .init '   # .init moved to 0x32028
$ readelf -dW shim.so | grep '(INIT)'    # DT_INIT still 0x224  <- stale

→ _dl_init calls the stale 0x224 (now overwritten by the appended Phdr) and SIGSEGVs on dlopen. Built from this PR, DT_INIT tracks .init and the library loads cleanly.

One caveat if you want it as a regression test: on current master, patchelf relocates the whole PHT to end-of-file for this binary instead of growing it in place, so .init isn't relocated and it's handled correctly even without this PR — the corruption only appears with the 0.18.0-era in-place growth. So this .so confirms #639 is real and that master no longer mangles it, but it wouldn't fail as a test without the DT_INIT change; you'd need an input that still takes the in-place-growth path to exercise that code directly. The binary is attached here: https://github.com/user-attachments/files/29332263/libpybind11nonlimitedapi_meshlib_3.12.so.zip

[domenkozar]

Thanks for the detailed confirmation and for recovering the real binary.

You're right, and it goes a bit deeper than this one binary. In rewriteSectionsLibrary the in place growth path bails to full PHT relocation as soon as it hits a non replaceable section in range, and .init is SHT_PROGBITS so it always triggers that. The executable path also refuses to move SHT_PROGBITS sections. So on current master .init never gets relocated in place, which is why your .so loads fine with or without the DT_INIT change.

Given that, I'll keep the #639 fix as defensive correctness (it mirrors the existing DT_STRTAB/DT_SYMTAB fixups) rather than add a regression test that can't actually fail. The #643 path is covered directly by the test in this PR.

Thanks again, the binary is a useful end to end sanity check.

[domenkozar]

Restructured this PR to build on @godlygeek's #644 rather than duplicate it:

• The patchelf fails to detect it must relocate the PHT when it is already not at the beginning of the file #643 fix is now his two commits (Ensure PHT collision detection checks the right spot + Fix collision detection for resized PHTs), cherry-picked with authorship preserved. His version is more precise than my original: it corrects the collision-detection range to [e_phoff, e_phoff + phtSize) and drops the bogus + sizeof(Elf_Ehdr) term, so it only relocates the PHT when there's a genuine collision instead of giving up in-place growth for any non-canonical PHT location.
• His synthetic pht-collision test replaces the 748 KB compressed libcrypto fixture I had added. It's deterministic, needs no blob, and handles ELF32/64 and endianness.
• My remaining commit is just the DT_INIT not updated when --set-rpath relocates .init in lld-produced ELFs (SIGSEGV on dlopen) #639 fix (update DT_INIT/DT_FINI/DT_INIT_ARRAY/DT_FINI_ARRAY/DT_PREINIT_ARRAY when those sections move), which Fix collision detection for resized PHTs #644 doesn't cover.

Verified locally: pht-collision.sh passes, and @Fedr's real lld binary patches cleanly into a valid ELF. If preferred, #644 can land on its own and I'll rebase the #639 commit on top.

[Mic92]

@domenkozar feel free to drop a release