Bug 21155

Summary: readelf segfault - PR 21137 seems to be incomplete
Product: binutils Reporter: Thuan Pham <thuanpv>
Component: binutilsAssignee: Not yet assigned to anyone <unassigned>
Status: RESOLVED FIXED    
Severity: normal CC: nickc
Priority: P2    
Version: 2.29   
Target Milestone: ---   
Host: Target:
Build: Last reconfirmed:
Attachments: Crashing input

Description Thuan Pham 2017-02-14 10:05:50 UTC
Created attachment 9822 [details]
Crashing input

Dear all,

This bug was found with AFLGo, a directed version of AFL/AFLFast. Thanks also to Marcel Böhme. 

This bug was found on Ubuntu 14.04 64-bit & binutils was checked out from main repository at git://sourceware.org/git/binutils-gdb.git. Its commit is 61697d017e114d7667fbb340fb73f8184d48ee5a (Tue Feb 14 00:00:30 2017) 

binutils was built with ASAN using gcc-6.2 and clang-3.4. The configure command was:

CC=clang CFLAGS="-DFORTIFY_SOURCE=2 -fstack-protector-all -fsanitize=undefined,address -fno-omit-frame-pointer -g -Wno-error" ../configure --disable-shared --disable-gdb --disable-libdecnumber --disable-readline --disable-sim

To reproduce:
Download the attached file - bug_1
readelf -w bug_1

Valgrind says:
readelf: Error: Section 7 has invalid sh_entsize of 0000000000001118
readelf: Error: (Using the expected size of 16 for the rest of this dump)
readelf: Error: Reading 0x210 bytes extends past end of file for symbols
readelf: Warning: unable to apply unsupported reloc type 8 to section .debug_info
readelf: Warning: unable to apply unsupported reloc type 0 to section .debug_info
readelf: Warning: unable to apply unsupported reloc type 10 to section .debug_info
readelf: Warning: unable to apply unsupported reloc type 53 to section .debug_info
readelf: Warning: unable to apply unsupported reloc type 8 to section .debug_info
readelf: Warning: unable to apply unsupported reloc type 2 to section .debug_info
==51968== 
==51968== Process terminating with default action of signal 11 (SIGSEGV)
==51968==  Bad permissions for mapped region at address 0x5033C3D
==51968==    at 0x438EAB: byte_put_little_endian (elfcomm.c:81)
==51968==    by 0x41D538: target_specific_reloc_handling (readelf.c:11805)
==51968==    by 0x41D538: apply_relocations (readelf.c:12431)
==51968==    by 0x41E506: load_specific_debug_section (readelf.c:13021)
==51968==    by 0x4239DA: display_debug_section (readelf.c:13125)
==51968==    by 0x4239DA: process_section_contents (readelf.c:13207)
==51968==    by 0x4239DA: process_object (readelf.c:16899)
==51968==    by 0x402111: process_file (readelf.c:17273)
==51968==    by 0x402111: main (readelf.c:17344)

=================================================================
==73882==ERROR: AddressSanitizer: SEGV on unknown address 0x610fffe39dbd (pc 0x00000072497d sp 0x7ffc4e09d0a0 bp 0x7ffc4e09d350 T0)
    #0 0x72497c in byte_put_little_endian /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/elfcomm.c:81
    #1 0x54da2b in target_specific_reloc_handling /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/readelf.c:11805
    #2 0x52e8de in apply_relocations /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/readelf.c:12431
    #3 0x4847c9 in load_specific_debug_section /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/readelf.c:13021
    #4 0x56654c in display_debug_section /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/readelf.c:13125
    #5 0x4e1a7f in process_section_contents /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/readelf.c:13207
    #6 0x48d720 in process_object /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/readelf.c:16899
    #7 0x488475 in process_file /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/readelf.c:17273
    #8 0x4856d3 in main /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/readelf.c:17344
    #9 0x7f3fd362af44 (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)
    #10 0x47ddfc in _start (/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/readelf+0x47ddfc)
Comment 1 cvs-commit@gcc.gnu.org 2017-02-14 13:25:25 UTC
The master branch has been updated by Nick Clifton <nickc@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b32e566ba6ee02687c6def22ade0899076adf7dd

commit b32e566ba6ee02687c6def22ade0899076adf7dd
Author: Nick Clifton <nickc@redhat.com>
Date:   Tue Feb 14 13:24:09 2017 +0000

    Fix illegal memory access problems with readelf processing corrupt RL78 binaries.
    
    	PR binutils/21155
    	* readelf.c (IN_RANGE): New macro.  Tests for an address + offset
    	being within a given range.
    	(target_specific_reloc_handling): Use macro to test for underflow
    	as well as overflow of reloc offset.
Comment 2 Nick Clifton 2017-02-14 13:27:35 UTC
Hi Thuan,

  Thanks for reporting this bug.  I have checked in a patch to fix the problem.

  *sigh* When I was generating the patch for 21137, I forgot to add a test for the reloc offset being so large that the address computation wrapped around to a location before the start of the buffer.  Doh.  This should now be fixed.

Cheers
  Nick