[Bug binutils/23686] New: two segment fault in nm in binutils-2.31.1

[92wyunchao at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23686

            Bug ID: 23686
           Summary: two segment fault in nm in binutils-2.31.1
           Product: binutils
           Version: 2.31
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: 92wyunchao at gmail dot com
  Target Milestone: ---

Created attachment 11262
  --> https://sourceware.org/bugzilla/attachment.cgi?id=11262&action=edit
poc file to reproduce the crash

Two egmentation faults in nm, attackers could leverage this vulnerability to
cause a denial of service (application crash) via a crafted ELF file.

$uname -a
Linux ubuntu 4.4.0-31-generic #50~14.04.1-Ubuntu SMP Wed Jul 13 01:06:37 UTC
2016 i686 i686 i686 GNU/Linux

$ASAN_OPTIONS=halt_on_error=false:allow_addr2line=true ./nm -A -a -l -S -s
--special-syms --synthetic --with-symbol-versions -D $POC1

ASan:
==21507==ERROR: AddressSanitizer: SEGV on unknown address 0x24600000 (pc
0x08171cdb sp 0xbfbb8800 bp 0x16c400de T0)
    #0 0x8171cda in bfd_zalloc
/home/rookie/asan/binutils-2.31.1/bfd/opncls.c:1000
    #1 0x84d24ba in _bfd_dwarf1_find_nearest_line
/home/rookie/asan/binutils-2.31.1/bfd/dwarf1.c:509
    #2 0x8336ab1 in _bfd_elf_find_nearest_line
/home/rookie/asan/binutils-2.31.1/bfd/elf.c:8757
    #3 0x80e4481 in print_symbol
/home/rookie/asan/binutils-2.31.1/binutils/nm.c:1009
    #4 0x80df268 in print_symbols
/home/rookie/asan/binutils-2.31.1/binutils/nm.c:1089
    #5 0x80df268 in display_rel_file
/home/rookie/asan/binutils-2.31.1/binutils/nm.c:1205
    #6 0x80da0d5 in display_file
/home/rookie/asan/binutils-2.31.1/binutils/nm.c:1325
    #7 0x80d6521 in main /home/rookie/asan/binutils-2.31.1/binutils/nm.c:1799
    #8 0xb7587af2 (/lib/i386-linux-gnu/libc.so.6+0x19af2)
    #9 0x80d4784 in _start
(/home/rookie/asan/binutils-2.31.1/tmp/bin/nm+0x80d4784)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
/home/rookie/asan/binutils-2.31.1/bfd/opncls.c:1000 bfd_zalloc


$ASAN_OPTIONS=halt_on_error=false:allow_addr2line=true ./nm -A -a -l -S -s
--special-syms --synthetic --with-symbol-versions -D $POC2

ASan:
==21562==ERROR: AddressSanitizer: SEGV on unknown address 0xb1a05f30 (pc
0xb757d0e6 sp 0xbfb05e68 bp 0xbfb05ea8 T0)
    #0 0xb757d0e5 (/lib/i386-linux-gnu/libc.so.6+0x940e5)
    #1 0x80a970f in index
(/home/rookie/asan/binutils-2.31.1/tmp/bin/nm+0x80a970f)
    #2 0x8192273 in _bfd_stab_section_find_nearest_line
/home/rookie/asan/binutils-2.31.1/bfd/syms.c:1421
    #3 0x8336e02 in _bfd_elf_find_nearest_line
/home/rookie/asan/binutils-2.31.1/bfd/elf.c:8768
    #4 0x80e4481 in print_symbol
/home/rookie/asan/binutils-2.31.1/binutils/nm.c:1009
    #5 0x80df268 in print_symbols
/home/rookie/asan/binutils-2.31.1/binutils/nm.c:1089
    #6 0x80df268 in display_rel_file
/home/rookie/asan/binutils-2.31.1/binutils/nm.c:1205
    #7 0x80da0d5 in display_file
/home/rookie/asan/binutils-2.31.1/binutils/nm.c:1325
    #8 0x80d6521 in main /home/rookie/asan/binutils-2.31.1/binutils/nm.c:1799
    #9 0xb7502af2 (/lib/i386-linux-gnu/libc.so.6+0x19af2)
    #10 0x80d4784 in _start
(/home/rookie/asan/binutils-2.31.1/tmp/bin/nm+0x80d4784)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 ??
==21562==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.