[Bug ld/20933] New: LD: Buffer Overflow if linker script does not exist

[boehme.marcel at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=20933

            Bug ID: 20933
           Summary: LD: Buffer Overflow if linker script does not exist
           Product: binutils
           Version: 2.28 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: ld
          Assignee: unassigned at sourceware dot org
          Reporter: boehme.marcel at gmail dot com
  Target Milestone: ---

Dear all,

The following bug was found with AFLFast, a fork of AFL, in a 24 hour fuzzing
session on Binutils. Thanks also to Van-Thuan Pham.

Valgrind reports an invalid read of size 4 when the referenced linker script
does not exist. The following execution does *not* actually crash the linker
for Binutils in trunk. There is no problem for Binutils v2.26.1 and v2.24.

$ ld -T test
ld: no input files

VALGRIND says:
==1339== Invalid read of size 4
==1339==    at 0x92C368: make_relative_prefix_1 (make-relative-prefix.c:385)
==1339==    by 0x4B97B7: find_scripts_dir (ldfile.c:518)
==1339==    by 0x4B97B7: ldfile_find_command_file (ldfile.c:554)
==1339==    by 0x4B97B7: ldfile_open_command_file_1 (ldfile.c:594)
==1339==    by 0x42B43C: parse_args (lexsup.c:1219)
==1339==    by 0x40CBFD: main (ldmain.c:312)

Best regards,
- Marcel

-- 
You are receiving this mail because:
You are on the CC list for the bug.