{"record":{"id":"191f36f505cb49ba","repo":"golang/go","slug":"invalid-pointers-found-in-go-fipsinfo-191f36","errorCode":null,"errorMessage":"invalid pointers found in go:fipsinfo","messagePattern":"invalid pointers found in go:fipsinfo","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/link/internal/ld/fips140.go","lineNumber":588,"sourceCode":"\t\treturn fmt.Errorf(\"corrupt pointer found in go:fipsinfo\")\n\t}\n\tdelta := peself - self\n\nAddrs:\n\tfor i := 0; i < 4; i++ {\n\t\tstart := int64(uptr(data[0:])) + delta\n\t\tend := int64(uptr(data[ctxt.Arch.PtrSize:])) + delta\n\t\tdata = data[2*ctxt.Arch.PtrSize:]\n\t\tfor _, sect := range pf.Sections {\n\t\t\tif int64(sect.VirtualAddress) <= start && start <= end && end <= int64(sect.VirtualAddress)+int64(sect.Size) {\n\t\t\t\toff := int64(sect.Offset) - int64(sect.VirtualAddress)\n\t\t\t\tif err := f.addSection(start+off, end+off); err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\t\t\t\tcontinue Addrs\n\t\t\t}\n\t\t}\n\t\treturn fmt.Errorf(\"invalid pointers found in go:fipsinfo\")\n\t}\n\n\t// Overwrite the go:fipsinfo sum field with the calculated sum.\n\tif _, err := wf.WriteAt(f.sum(), int64(sect.Offset)+off+fipsMagicLen); err != nil {\n\t\treturn err\n\t}\n\tif err := wf.Close(); err != nil {\n\t\treturn err\n\t}\n\treturn f.Close()\n}\n","sourceCodeStart":570,"sourceCodeEnd":600,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/link/internal/ld/fips140.go#L570-L600","documentation":"While finalizing a binary, the Go linker computes a FIPS-140 integrity hash by walking the `go:fipsinfo` symbol, which holds start/end pointer pairs delimiting the code/data regions that must be hashed. After applying the relocation delta, every (start,end) pair must lie entirely inside one registered output section (text, rodata, etc.). If no section fully contains a pair, the linker cannot certify the binary's integrity and aborts rather than emit an un-verifiable image.","triggerScenarios":"Triggered at link time when building with FIPS-enabled crypto (GOEXPERIMENT=boringcrypto or `GOFLAGS=-tags=fips140`) and the section layout is non-standard: custom external linker scripts (`-ldflags='-extldflags -T ...'`), `-cover`/`-race` instrumentation that inserts extra sections, `-overlay` builds, or object files compiled by a mismatched Go toolchain version that emit a different fipsinfo shape.","commonSituations":"Mixing `.o`/`.a` artifacts from different Go versions in one build cache; using a hand-rolled linker script with cgo; a stale or corrupted build cache after a Go upgrade; building with experimental flags that relocate sections the fips pass does not know about.","solutions":["Run `go clean -cache` then rebuild — a stale cache after a toolchain upgrade is the most common cause.","Ensure every package (including cgo C objects) is compiled with the exact same Go version and GOEXPERIMENT setting.","Remove custom `-extldflags` linker scripts and `-T` section-layout flags; let the linker choose the default layout.","If using `-overlay` or modified runtime sources, disable FIPS mode (`GOEXPERIMENT=noboringcrypto`) or restore the unmodified `crypto/internal/fips140` sources.","File a bug against the Go toolchain if the error persists with a clean cache and stock flags — it indicates the fipsinfo symbol's pointers legitimately do not match the output sections."],"exampleFix":"# before\nGOFLAGS=-tags=fips140 go build -ldflags='-extldflags -T custom.lds' ./...\n\n# after\ngo clean -cache\nGOFLAGS=-tags=fips140 go build ./...","handlingStrategy":"fallback","validationCode":"# Ensure no mixed toolchain versions in the build\nGO_VERSION=$(go version)\nfind . -name '*.o' -o -name '*.a' | xargs -r file | grep -v \"$GO_VERSION\" || echo 'objects consistent'\n\n# Verify fipsinfo symbol exists and is well-formed in a test build\ngo build -o /tmp/check_bin ./... && objdump -t /tmp/check_bin | grep fipsinfo","typeGuard":null,"tryCatchPattern":"# In CI, link and fall back to a clean rebuild on fips failure\nset +e\ngo build -o bin/app ./...\nrc=$?\nset -e\nif [ $rc -ne 0 ]; then\n  echo 'link failed; attempting clean rebuild'\n  go clean -cache\n  go build -a -o bin/app ./...\nfi","preventionTips":["Pin a single Go toolchain version across the whole team and CI.","Run `go clean -cache` after every toolchain upgrade.","Avoid custom `-extldflags` section-layout scripts in FIPS builds.","Do not mix objects from `GOEXPERIMENT=boringcrypto` and non-boringcrypto builds."],"tags":["linker","go-toolchain","fips140","build","relocation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}