[Bug binutils/29699] New: Segmentation fault caused by null pointer dereference in nm-new, _bfd_elf_get_symbol_version_string, elf.c:1969

[featherrain26 at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29699

            Bug ID: 29699
           Summary: Segmentation fault caused by null pointer dereference
                    in nm-new, _bfd_elf_get_symbol_version_string,
                    elf.c:1969
           Product: binutils
           Version: 2.40 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: featherrain26 at gmail dot com
  Target Milestone: ---

Created attachment 14404
  --> https://sourceware.org/bugzilla/attachment.cgi?id=14404&action=edit
POC

Hi, there.

There is a null pointer dereference in the newest version(2.39.50.20221019,
commit 9454c9ce) of nm-new, bfd_elf_get_symbol_version_string, elf.c:1969,
which directly causes a segmentation fault.

My environment is:
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=20.04
DISTRIB_CODENAME=focal
DISTRIB_DESCRIPTION="Ubuntu 20.04.5 LTS"

Compiler=gcc 9.4.0

To reproduce, run
nm-new -aD poc

Here is the trace reported by ASAN:

==2056575==ERROR: AddressSanitizer: SEGV on unknown address 0x0006c6258006 (pc
0x0000005b6eee bp 0x0c240000002a sp 0x7ffe8702e440 T0)
==2056575==The signal is caused by a READ memory access.
    #0 0x5b6eee in _bfd_elf_get_symbol_version_string 
/benchmark/binutils-gdb/build-a/bfd/../../bfd/elf.c
    #1 0x4fbe13 in print_symname 
/benchmark/binutils-gdb/build-a/binutils/../../binutils/nm.c:715:4
    #2 0x50055c in print_symbol 
/benchmark/binutils-gdb/build-a/binutils/../../binutils/nm.c:1219:3
    #3 0x4fea41 in print_symbols 
/benchmark/binutils-gdb/build-a/binutils/../../binutils/nm.c:1403:7
    #4 0x4fea41 in display_rel_file 
/benchmark/binutils-gdb/build-a/binutils/../../binutils/nm.c:1530:5
    #5 0x4f9885 in display_file 
/benchmark/binutils-gdb/build-a/binutils/../../binutils/nm.c:1680:7
    #6 0x4f888f in main 
/benchmark/binutils-gdb/build-a/binutils/../../binutils/nm.c:2197:12
    #7 0x7f912956e082 in __libc_start_main
/build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #8 0x41d57d in _start (
/benchmark/binutils-gdb/build-a/binutils/nm-new+0x41d57d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV 
/benchmark/binutils-gdb/build-a/bfd/../../bfd/elf.c in
_bfd_elf_get_symbol_version_string
==2056575==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.