fuzz: add a target for the ELF symbol-resolution paths

[perbu]

fuzz.cpp drives the loader only. section_by_name(), resolve_symbol() and resolve() hang off AddressOf() / address_of() / resolve(), which the loader never calls — so those three have had zero fuzz coverage.

That is not a niche corner: resolve() runs on every guest fault, because handle_exception() calls it to symbolise the faulting address. An adversarial ELF reaches the section and symbol walkers with nothing more than a guest that crashes on purpose.

elfsymfuzzer calls all three with an input-derived symbol name and rip.

Results against the current tree

All nine seeds run in about two seconds:

seed	result	location
shnum_huge	SEGV	machine_elf.cpp:251	#100
shstrndx_oob	SEGV	:246	#100
stname_wild	SEGV	:278	#100
symtab_size_huge	heap-buffer-overflow	:328	#100
symbol_name_4k	stack-buffer-overflow	:303	#100
symtab_misaligned	UBSan misaligned access	:277	new, see below
valid, header_only, shoff_wrap	clean

symtab_misaligned is not part of #100. resolve_symbol() casts a file offset straight to Elf64_Sym* with no alignment check, so the ELF author picks the alignment. Benign on x86-64, a fault on strict-alignment targets — this is the seed whose value is realised by running the target under UBSan on AArch64, which is the highest-value harness gap on the list.

Two harness details that are load-bearing

• The image is copied into an aligned buffer, not pointed at in place. machine_elf.cpp casts the base pointer to Elf64_Ehdr*, and libFuzzer's input is not 8-aligned once the name/rip header is stripped off it. Without the copy, every input reports misaligned access and buries everything else. (I hit this; it is why the first version of this target looked like it found nothing.)
• resolve()'s return length is asserted against its 2048-byte format buffer. That needs to be explicit: the copy compiles to an inline rep movsb, which ASan does not instrument, so a moderate over-read runs clean under the sanitizer.

On the seeds

gen_elf_symbol_seeds.py writes minimal ELFs with one poisoned header field each, because bit-flipping a valid binary essentially never produces an e_shnum past EOF or an offset that wraps. Two things to preserve if these are edited, both of which cost me a debugging round:

• the searched section must be absent, or section_by_name() returns on the match long before it walks off the end;
• .symtab must be 8-aligned, or UBSan reports the cast before the loop reaches the bug the seed is aiming at.

The phdr-side wraps in is_dynamic_elf()/elf_load_ph (the rest of #100) belong to the elffuzzer target, which drives the loader — seeds for them would be dead weight here.

🤖 Generated with Claude Code