[Bug binutils/21157] New: objdump segfault

bug-binutils

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Bug binutils/21157] New: objdump segfault - of-by-one read

From:	thuanpv at comp dot nus.edu.sg
Subject:	[Bug binutils/21157] New: objdump segfault - of-by-one read
Date:	Tue, 14 Feb 2017 10:11:59 +0000

https://sourceware.org/bugzilla/show_bug.cgi?id=21157

            Bug ID: 21157
           Summary: objdump segfault - of-by-one read
           Product: binutils
           Version: 2.29 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: thuanpv at comp dot nus.edu.sg
  Target Milestone: ---

Created attachment 9824
  --> https://sourceware.org/bugzilla/attachment.cgi?id=9824&action=edit
Crashing input

Dear all,

This bug was found with AFLGo, a directed version of AFL/AFLFast. Thanks also
to Marcel Böhme. 

This bug was found on Ubuntu 14.04 64-bit & binutils was checked out from main
repository at git://sourceware.org/git/binutils-gdb.git. Its commit is
61697d017e114d7667fbb340fb73f8184d48ee5a (Tue Feb 14 00:00:30 2017) 

binutils was built with ASAN using gcc-6.2 and clang-3.4. The configure command
was:

CC=clang CFLAGS="-DFORTIFY_SOURCE=2 -fstack-protector-all
-fsanitize=undefined,address -fno-omit-frame-pointer -g -Wno-error"
../configure --disable-shared --disable-gdb --disable-libdecnumber
--disable-readline --disable-sim

To reproduce:
Download the attached file - objdump_bug_1
objdump -g objdump_bug_1


Valgrind says:
==105891== Conditional jump or move depends on uninitialised value(s)
==105891==    at 0x4283E8: parse_stab_enum_type (stabs.c:1978)
==105891==    by 0x4283E8: parse_stab_type (stabs.c:1554)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x42AE36: parse_stab_string (stabs.c:815)
==105891==    by 0x42AE36: parse_stab (stabs.c:651)
==105891==    by 0x4214EC: read_symbol_stabs_debugging_info (rddbg.c:321)
==105891==    by 0x4214EC: read_debugging_info (rddbg.c:62)
==105891==    by 0x408402: dump_bfd (objdump.c:3513)
==105891==    by 0x4089AF: display_object_bfd (objdump.c:3564)
==105891==    by 0x4089AF: display_any_bfd (objdump.c:3653)
==105891== 
==105891== Invalid read of size 1
==105891==    at 0x4283E4: parse_stab_enum_type (stabs.c:1978)
==105891==    by 0x4283E4: parse_stab_type (stabs.c:1554)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x42AE36: parse_stab_string (stabs.c:815)
==105891==    by 0x42AE36: parse_stab (stabs.c:651)
==105891==    by 0x4214EC: read_symbol_stabs_debugging_info (rddbg.c:321)
==105891==    by 0x4214EC: read_debugging_info (rddbg.c:62)
==105891==    by 0x408402: dump_bfd (objdump.c:3513)
==105891==    by 0x4089AF: display_object_bfd (objdump.c:3564)
==105891==    by 0x4089AF: display_any_bfd (objdump.c:3653)
==105891==  Address 0x5411f60 is 0 bytes after a block of size 256 alloc'd
==105891==    at 0x4C2AB80: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==105891==    by 0x449F9D: bfd_malloc (libbfd.c:184)
==105891==    by 0x49CB82: aout_get_external_symbols (aoutx.h:1359)
==105891==    by 0x4A03F8: aout_32_slurp_symbol_table (aoutx.h:1755)
==105891==    by 0x4A1628: aout_32_get_symtab_upper_bound (aoutx.h:2520)
==105891==    by 0x407DB2: slurp_symtab (objdump.c:611)
==105891==    by 0x407DB2: dump_bfd (objdump.c:3476)
==105891==    by 0x4089AF: display_object_bfd (objdump.c:3564)
==105891==    by 0x4089AF: display_any_bfd (objdump.c:3653)
==105891==    by 0x40AC63: display_file (objdump.c:3674)
==105891==    by 0x404CBD: main (objdump.c:3969)
==105891== 
==105891== Invalid read of size 8
==105891==    at 0x4C2F79E: memcpy@@GLIBC_2.14 (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==105891==    by 0x425034: memcpy (string3.h:51)
==105891==    by 0x425034: savestring (stabs.c:217)
==105891==    by 0x4283F7: parse_stab_enum_type (stabs.c:1981)
==105891==    by 0x4283F7: parse_stab_type (stabs.c:1554)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x42AE36: parse_stab_string (stabs.c:815)
==105891==    by 0x42AE36: parse_stab (stabs.c:651)
==105891==    by 0x4214EC: read_symbol_stabs_debugging_info (rddbg.c:321)
==105891==    by 0x4214EC: read_debugging_info (rddbg.c:62)
==105891==  Address 0x5411f60 is 0 bytes after a block of size 256 alloc'd
==105891==    at 0x4C2AB80: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==105891==    by 0x449F9D: bfd_malloc (libbfd.c:184)
==105891==    by 0x49CB82: aout_get_external_symbols (aoutx.h:1359)
==105891==    by 0x4A03F8: aout_32_slurp_symbol_table (aoutx.h:1755)
==105891==    by 0x4A1628: aout_32_get_symtab_upper_bound (aoutx.h:2520)
==105891==    by 0x407DB2: slurp_symtab (objdump.c:611)
==105891==    by 0x407DB2: dump_bfd (objdump.c:3476)
==105891==    by 0x4089AF: display_object_bfd (objdump.c:3564)
==105891==    by 0x4089AF: display_any_bfd (objdump.c:3653)
==105891==    by 0x40AC63: display_file (objdump.c:3674)
==105891==    by 0x404CBD: main (objdump.c:3969)
==105891== 
==105891== Invalid read of size 8
==105891==    at 0x4C2F790: memcpy@@GLIBC_2.14 (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==105891==    by 0x425034: memcpy (string3.h:51)
==105891==    by 0x425034: savestring (stabs.c:217)
==105891==    by 0x4283F7: parse_stab_enum_type (stabs.c:1981)
==105891==    by 0x4283F7: parse_stab_type (stabs.c:1554)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x427B12: parse_stab_type (stabs.c:1369)
==105891==    by 0x42AE36: parse_stab_string (stabs.c:815)
==105891==    by 0x42AE36: parse_stab (stabs.c:651)
==105891==    by 0x4214EC: read_symbol_stabs_debugging_info (rddbg.c:321)
==105891==    by 0x4214EC: read_debugging_info (rddbg.c:62)
==105891==  Address 0x5411f68 is 8 bytes after a block of size 256 alloc'd
==105891==    at 0x4C2AB80: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==105891==    by 0x449F9D: bfd_malloc (libbfd.c:184)
==105891==    by 0x49CB82: aout_get_external_symbols (aoutx.h:1359)
==105891==    by 0x4A03F8: aout_32_slurp_symbol_table (aoutx.h:1755)
==105891==    by 0x4A1628: aout_32_get_symtab_upper_bound (aoutx.h:2520)
==105891==    by 0x407DB2: slurp_symtab (objdump.c:611)
==105891==    by 0x407DB2: dump_bfd (objdump.c:3476)
==105891==    by 0x4089AF: display_object_bfd (objdump.c:3564)
==105891==    by 0x4089AF: display_any_bfd (objdump.c:3653)
==105891==    by 0x40AC63: display_file (objdump.c:3674)
==105891==    by 0x404CBD: main (objdump.c:3969)


ASAN says:
==122274==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x611000009c40 at pc 0x6ca71e bp 0x7ffd26801c10 sp 0x7ffd26801c08
READ of size 1 at 0x611000009c40 thread T0
    #0 0x6ca71d in parse_stab_enum_type
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1978
    #1 0x6bc4e1 in parse_stab_type
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1554
    #2 0x6b9a33 in parse_stab_type
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1370
    #3 0x6b9a33 in parse_stab_type
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1370
    #4 0x6b9a33 in parse_stab_type
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1370
    #5 0x6b9a33 in parse_stab_type
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1370
    #6 0x6b9a33 in parse_stab_type
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1370
    #7 0x6b9a33 in parse_stab_type
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1370
    #8 0x6b9a33 in parse_stab_type
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1370
    #9 0x6adcfc in parse_stab_string
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:815
    #10 0x6a6fa8 in parse_stab
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:651
    #11 0x621eb4 in read_symbol_stabs_debugging_info
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/rddbg.c:321
    #12 0x61aecd in read_debugging_info
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/rddbg.c:62
    #13 0x498f7b in dump_bfd
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/objdump.c:3513
    #14 0x4978fb in display_object_bfd
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/objdump.c:3564
    #15 0x497698 in display_any_bfd
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/objdump.c:3653
    #16 0x495ebe in display_file
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/objdump.c:3674
    #17 0x493edd in main
/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/objdump.c:3969
    #18 0x7fa29e80ef44 (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)
    #19 0x48c95c in _start
(/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/objdump+0x48c95c)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Prev in Thread]

Current Thread

[Next in Thread]

[Bug binutils/21157] New: objdump segfault - of-by-one read, thuanpv at comp dot nus.edu.sg <=
- [Bug binutils/21157] objdump segfault - of-by-one read, cvs-commit at gcc dot gnu.org, 2017/02/14
- [Bug binutils/21157] objdump segfault - of-by-one read, nickc at redhat dot com, 2017/02/14
- [Bug binutils/21157] objdump segfault - off-by-one read, thuanpv at comp dot nus.edu.sg, 2017/02/14

Prev by Date: [Bug binutils/21156] New: readefl segfault - invalid read of size 4
Next by Date: [Bug binutils/21158] New: objdump - of-by-one global-buffer-overflow
Previous by thread: [Bug binutils/21156] New: readefl segfault - invalid read of size 4
Next by thread: [Bug binutils/21157] objdump segfault - of-by-one read
Index(es):
- Date
- Thread