{"record":{"id":"58b30759471d0b72","repo":"golang/go","slug":"invalid-pointers-found-in-go-fipsinfo","errorCode":null,"errorMessage":"invalid pointers found in .go.fipsinfo","messagePattern":"invalid pointers found in \\.go\\.fipsinfo","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/link/internal/ld/fips140.go","lineNumber":466,"sourceCode":"\t// the data holds the actual pointers.\n\t// This code handles both pie and non-pie binaries.\n\tdata = data[fipsMagicLen+fipsSumLen:]\n\tdata = data[ctxt.Arch.PtrSize:]\n\nAddrs:\n\tfor i := 0; i < 4; i++ {\n\t\tstart := uptr(data[0:])\n\t\tend := uptr(data[ctxt.Arch.PtrSize:])\n\t\tdata = data[2*ctxt.Arch.PtrSize:]\n\t\tfor _, prog := range ef.Progs {\n\t\t\tif prog.Type == elf.PT_LOAD && prog.Vaddr <= start && start <= end && end <= prog.Vaddr+prog.Filesz {\n\t\t\t\tif err := f.addSection(int64(start+prog.Off-prog.Vaddr), int64(end+prog.Off-prog.Vaddr)); err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\t\t\t\tcontinue Addrs\n\t\t\t}\n\t\t}\n\t\treturn fmt.Errorf(\"invalid pointers found in .go.fipsinfo\")\n\t}\n\n\t// Overwrite the go:fipsinfo sum field with the calculated sum.\n\tif _, err := wf.WriteAt(f.sum(), int64(sect.Offset)+fipsMagicLen); err != nil {\n\t\treturn err\n\t}\n\tif err := wf.Close(); err != nil {\n\t\treturn err\n\t}\n\treturn f.Close()\n}\n\n// pefips updates go:fipsinfo after external linking\n// on systems using PE (GOOS=windows).\nfunc pefips(ctxt *Link, exe, fipso string) error {\n\t// Open executable both for reading Mach-O and for the fipsObj.\n\tpf, err := pe.Open(exe)\n\tif err != nil {","sourceCodeStart":448,"sourceCodeEnd":484,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/link/internal/ld/fips140.go#L448-L484","documentation":"During ELF FIPS post-link processing, the code reads four pairs of start/end pointers from the .go.fipsinfo section and validates each pair against the binary's PT_LOAD program headers. If a pointer pair's start/end range does not fall within any PT_LOAD segment, the pointers are invalid — they point outside mapped memory regions.","triggerScenarios":"The elffips function loops 4 times reading start/end address pairs via uptr(). For each pair, it iterates ef.Progs checking if any PT_LOAD segment contains the range [start, end]. If no segment matches, the error is returned immediately. This indicates the FIPS info contains pointers that do not correspond to valid loadable segments.","commonSituations":"The binary was modified after linking (e.g. binary editing, section relocation); a linker bug in computing FIPS info pointer ranges; mixing static and shared linking modes that change segment layout; using LTO or other link-time transformations that alter the address layout.","solutions":["Clean rebuild: go clean -cache && GOFIPS=1 go build","Report as a Go linker bug at https://github.com/golang/go/issues with the binary and build flags","Check if any post-link binary modification tools (upx, strip, patchelf) were run on the binary","Verify no custom linker scripts alter the ELF segment layout","Try -linkmode=internal vs -linkmode=external to isolate the issue"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Wrap pointer validation errors with rebuild guidance\nif err := validateFipsPointers(ef, data); err != nil {\n    return fmt.Errorf(\"%w — try go clean -cache && go build\", err)\n}","preventionTips":["Do not run binary modification tools (upx, strip, patchelf) on FIPS-enabled binaries","Avoid custom ELF linker scripts that alter segment layouts","Clean rebuild when encountering pointer validation errors","Report persistent issues as Go linker bugs"],"tags":["fips","fips140","elf","linker","go-toolchain","pointer-validation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}