What version of Go are you using (go version)?

$ go version
1.20.2

Does this issue reproduce with the latest release?

Yes

What did you do?

Using binary 2a2513e8687993ed71cc48b09676abf18bb0e739f15473d36c50627b05036686 (on VT) running the buildid code over the sample fails to correctly read the notes section. This is not a Go binary, however this does excersize a failure case in the build id code here:

//note.go readELF

off += notesz
align := p.Align
alignedOff := (off + align - 1) &^ (align - 1)
notesz += alignedOff - off
off = alignedOff
filesz -= notesz
note = note[notesz:]

The alignedOff is aligned to zero while the offset is positive leading to an underflow when the notesz is calculated. This later leads to an invalid array access at note = note[notesz:]

To fix, the code should ignore alignment when it's zero:

off += notesz
align := p.Align
if align != 0 {
    alignedOff := (off + align - 1) &^ (align - 1)
    notesz += alignedOff - off
    off = alignedOff
}
filesz -= notesz
note = note[notesz:]