Why does the tool "readelf" outputs two ELF file section count numbers?

Question

I am currently investigating an issue with our tool which reads and interprets ELF files, that has an problem reading a specific elf file.

The unix tool "readelf" with the option "-h" outputs 2 values for the parameter "Number of section headers". There is an additional one after the initial number.

Example for the file that works:

Number of section headers: 1234

Example for the file that does not work:

Number of section headers: 0 (4524)

What does the number in the brackets mean? I guess it could be the cause for my issue as our application thinks there are no sections in the problematic file.

Answer 1

Here is the relevant code in the readelf source. . It looks like if header->e_shnum has the value SHN_UNDEF (zero) then what's printed in parentheses is the value of filedata->section_headers[0].sh_size .

This corresponds to the following passage in the elf(5) man page :

 e_shnum This member holds the number of entries in the section header table. Thus the product of e_shentsize and e_shnum gives the section header table's size in bytes. If a file has no section header table, e_shnum holds the value of zero. If the number of entries in the section header table is larger than or equal to SHN_LORESERVE (0xff00), e_shnum holds the value zero and the real number of entries in the section header table is held in the sh_size member of the initial entry in section header table. Otherwise, the sh_size member of the initial entry in the section header table holds the value zero.

So this would be a valid way to specify that the section header table has 74496 entries (which indeed is larger than 0xff00 ). It seems you need to fix your tool to handle this case.