GNU comdat redirection does exactly the wrong thing
In gnu_comdat_sym we attempt to determine whether a section name is that of a GNU comdat section, which are named '<sectionname>.<signaturesymbolname>'.
We do this by iterating all sections looking for a section which is not ourselves, which matches our name up to its own length, and is followed, in our name, by a '.'.
Unfortunately, what we do is this:
ssize = strlen(isp->is_name); if ((strncmp(isp->is_name, gisp->is_name, ssize) != 0) && (gisp->is_name[ssize] == '.')) return ((char *)&gisp->is_name[ssize]);
Notice how in the above, what we are actually doing is making sure that the name is not a prefix of our own, but would in our own be followed by a '.'
This actually works surprisingly often, but only because '.data' and '.text' are the same length. When it fails, the results are catastraphic (but sometimes work anyway, because of the wonder of ELF)