[Bug binutils/17531] readelf -a crashes on fuzzed samples

[espen at grindhaug dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=17531

--- Comment #36 from Espen Grindhaug <espen at grindhaug dot org> ---
Created attachment 7954
  --> https://sourceware.org/bugzilla/attachment.cgi?id=7954&action=edit
2 more problematic test cases

(In reply to Nick Clifton from comment #35)
> Hi Espen, Hi Alexander,
> 
>   OK, those two are fixed.  Next ?
> 
> Cheers
>   Nick

It's getting harder to find problems, but attached you find two test cases. One
of them seems to get into an infinite loop. The other crashes like this:

Program received signal SIGSEGV, Segmentation fault.
#0  __strncpy_sse2_unaligned () at
../sysdeps/x86_64/multiarch/strcpy-sse2-unaligned.S:1669
#1  0x0000000000443d56 in strncpy (__len=<optimized out>, __src=<optimized
out>, __dest=<optimized out>) at
/usr/include/x86_64-linux-gnu/bits/string3.h:120
#2  process_corefile_note_segment (file=0x55b000, offset=5486616,
length=5486616) at readelf.c:14715
#3  0x0000000000492f1a in process_corefile_note_segment (length=<optimized
out>, offset=<optimized out>, file=<optimized out>) at readelf.c:4178
#4  process_note_sections (file=<optimized out>) at readelf.c:14772
#5  process_notes (file=<optimized out>) at readelf.c:14793
#6  process_object (file_name=0x53b750 "", file=0x1, address@hidden) at
readelf.c:15011
#7  0x0000000000403c69 in process_file (file_name=0x7fffffffe29b
"id:000000,sig:11,src:006986,op:havoc,rep:4") at readelf.c:15382
#8  main (argc=3, argv=0x7fffffffdef8) at readelf.c:15448

Espen

-- 
You are receiving this mail because:
You are on the CC list for the bug.