golang/go · error

invalid pointers found in .go.fipsinfo

Error message

invalid pointers found in .go.fipsinfo

What it means

During ELF FIPS post-link processing, the code reads four pairs of start/end pointers from the .go.fipsinfo section and validates each pair against the binary's PT_LOAD program headers. If a pointer pair's start/end range does not fall within any PT_LOAD segment, the pointers are invalid — they point outside mapped memory regions.

Source

Thrown at src/cmd/link/internal/ld/fips140.go:466

	// the data holds the actual pointers.
	// This code handles both pie and non-pie binaries.
	data = data[fipsMagicLen+fipsSumLen:]
	data = data[ctxt.Arch.PtrSize:]

Addrs:
	for i := 0; i < 4; i++ {
		start := uptr(data[0:])
		end := uptr(data[ctxt.Arch.PtrSize:])
		data = data[2*ctxt.Arch.PtrSize:]
		for _, prog := range ef.Progs {
			if prog.Type == elf.PT_LOAD && prog.Vaddr <= start && start <= end && end <= prog.Vaddr+prog.Filesz {
				if err := f.addSection(int64(start+prog.Off-prog.Vaddr), int64(end+prog.Off-prog.Vaddr)); err != nil {
					return err
				}
				continue Addrs
			}
		}
		return fmt.Errorf("invalid pointers found in .go.fipsinfo")
	}

	// Overwrite the go:fipsinfo sum field with the calculated sum.
	if _, err := wf.WriteAt(f.sum(), int64(sect.Offset)+fipsMagicLen); err != nil {
		return err
	}
	if err := wf.Close(); err != nil {
		return err
	}
	return f.Close()
}

// pefips updates go:fipsinfo after external linking
// on systems using PE (GOOS=windows).
func pefips(ctxt *Link, exe, fipso string) error {
	// Open executable both for reading Mach-O and for the fipsObj.
	pf, err := pe.Open(exe)
	if err != nil {

View on GitHub (pinned to b6b368adc5)

Solutions

1. Clean rebuild: go clean -cache && GOFIPS=1 go build
2. Report as a Go linker bug at https://github.com/golang/go/issues with the binary and build flags
3. Check if any post-link binary modification tools (upx, strip, patchelf) were run on the binary
4. Verify no custom linker scripts alter the ELF segment layout
5. Try -linkmode=internal vs -linkmode=external to isolate the issue

// Wrap pointer validation errors with rebuild guidance
if err := validateFipsPointers(ef, data); err != nil {
    return fmt.Errorf("%w — try go clean -cache && go build", err)
}

When it happens

Trigger: The elffips function loops 4 times reading start/end address pairs via uptr(). For each pair, it iterates ef.Progs checking if any PT_LOAD segment contains the range [start, end]. If no segment matches, the error is returned immediately. This indicates the FIPS info contains pointers that do not correspond to valid loadable segments.

Common situations: The binary was modified after linking (e.g. binary editing, section relocation); a linker bug in computing FIPS info pointer ranges; mixing static and shared linking modes that change segment layout; using LTO or other link-time transformations that alter the address layout.

Related errors

• cannot find .go.fipsinfo
• fips unsupported on %s
• cannot find __go_fipsinfo
• cannot find .data
• scanning PE for FIPS magic: %v

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/58b30759471d0b72. Report an issue: GitHub.