| Summary: | objdump segfault - off-by-one read | ||
|---|---|---|---|
| Product: | binutils | Reporter: | Thuan Pham <thuanpv> |
| Component: | binutils | Assignee: | Not yet assigned to anyone <unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | nickc |
| Priority: | P2 | ||
| Version: | 2.29 | ||
| Target Milestone: | --- | ||
| Host: | Target: | ||
| Build: | Last reconfirmed: | ||
| Attachments: | Crashing input | ||
The master branch has been updated by Nick Clifton <nickc@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=a2dea0b20bc66a4c287c3c50002b8c3b3e9d953a commit a2dea0b20bc66a4c287c3c50002b8c3b3e9d953a Author: Nick Clifton <nickc@redhat.com> Date: Tue Feb 14 14:07:29 2017 +0000 Fix handling of corrupt STABS enum type strings. PR binutils/21157 * stabs.c (parse_stab_enum_type): Check for corrupt NAME:VALUE pairs. (parse_number): Exit early if passed an empty string. Hi Thuan, Thanks for reporting this bug. I have checked in a patch to fix the problem. The problem is with the BFD library's handling of STABS debug information, which was written a long time ago and without security in mind. The applied patch fixes the specific point of failure triggered by your testcase, but I suspect that there will be more to come in the future... Cheers Nick This is CVE-2017-7210 |
Created attachment 9824 [details] Crashing input Dear all, This bug was found with AFLGo, a directed version of AFL/AFLFast. Thanks also to Marcel Böhme. This bug was found on Ubuntu 14.04 64-bit & binutils was checked out from main repository at git://sourceware.org/git/binutils-gdb.git. Its commit is 61697d017e114d7667fbb340fb73f8184d48ee5a (Tue Feb 14 00:00:30 2017) binutils was built with ASAN using gcc-6.2 and clang-3.4. The configure command was: CC=clang CFLAGS="-DFORTIFY_SOURCE=2 -fstack-protector-all -fsanitize=undefined,address -fno-omit-frame-pointer -g -Wno-error" ../configure --disable-shared --disable-gdb --disable-libdecnumber --disable-readline --disable-sim To reproduce: Download the attached file - objdump_bug_1 objdump -g objdump_bug_1 Valgrind says: ==105891== Conditional jump or move depends on uninitialised value(s) ==105891== at 0x4283E8: parse_stab_enum_type (stabs.c:1978) ==105891== by 0x4283E8: parse_stab_type (stabs.c:1554) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x42AE36: parse_stab_string (stabs.c:815) ==105891== by 0x42AE36: parse_stab (stabs.c:651) ==105891== by 0x4214EC: read_symbol_stabs_debugging_info (rddbg.c:321) ==105891== by 0x4214EC: read_debugging_info (rddbg.c:62) ==105891== by 0x408402: dump_bfd (objdump.c:3513) ==105891== by 0x4089AF: display_object_bfd (objdump.c:3564) ==105891== by 0x4089AF: display_any_bfd (objdump.c:3653) ==105891== ==105891== Invalid read of size 1 ==105891== at 0x4283E4: parse_stab_enum_type (stabs.c:1978) ==105891== by 0x4283E4: parse_stab_type (stabs.c:1554) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x42AE36: parse_stab_string (stabs.c:815) ==105891== by 0x42AE36: parse_stab (stabs.c:651) ==105891== by 0x4214EC: read_symbol_stabs_debugging_info (rddbg.c:321) ==105891== by 0x4214EC: read_debugging_info (rddbg.c:62) ==105891== by 0x408402: dump_bfd (objdump.c:3513) ==105891== by 0x4089AF: display_object_bfd (objdump.c:3564) ==105891== by 0x4089AF: display_any_bfd (objdump.c:3653) ==105891== Address 0x5411f60 is 0 bytes after a block of size 256 alloc'd ==105891== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==105891== by 0x449F9D: bfd_malloc (libbfd.c:184) ==105891== by 0x49CB82: aout_get_external_symbols (aoutx.h:1359) ==105891== by 0x4A03F8: aout_32_slurp_symbol_table (aoutx.h:1755) ==105891== by 0x4A1628: aout_32_get_symtab_upper_bound (aoutx.h:2520) ==105891== by 0x407DB2: slurp_symtab (objdump.c:611) ==105891== by 0x407DB2: dump_bfd (objdump.c:3476) ==105891== by 0x4089AF: display_object_bfd (objdump.c:3564) ==105891== by 0x4089AF: display_any_bfd (objdump.c:3653) ==105891== by 0x40AC63: display_file (objdump.c:3674) ==105891== by 0x404CBD: main (objdump.c:3969) ==105891== ==105891== Invalid read of size 8 ==105891== at 0x4C2F79E: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==105891== by 0x425034: memcpy (string3.h:51) ==105891== by 0x425034: savestring (stabs.c:217) ==105891== by 0x4283F7: parse_stab_enum_type (stabs.c:1981) ==105891== by 0x4283F7: parse_stab_type (stabs.c:1554) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x42AE36: parse_stab_string (stabs.c:815) ==105891== by 0x42AE36: parse_stab (stabs.c:651) ==105891== by 0x4214EC: read_symbol_stabs_debugging_info (rddbg.c:321) ==105891== by 0x4214EC: read_debugging_info (rddbg.c:62) ==105891== Address 0x5411f60 is 0 bytes after a block of size 256 alloc'd ==105891== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==105891== by 0x449F9D: bfd_malloc (libbfd.c:184) ==105891== by 0x49CB82: aout_get_external_symbols (aoutx.h:1359) ==105891== by 0x4A03F8: aout_32_slurp_symbol_table (aoutx.h:1755) ==105891== by 0x4A1628: aout_32_get_symtab_upper_bound (aoutx.h:2520) ==105891== by 0x407DB2: slurp_symtab (objdump.c:611) ==105891== by 0x407DB2: dump_bfd (objdump.c:3476) ==105891== by 0x4089AF: display_object_bfd (objdump.c:3564) ==105891== by 0x4089AF: display_any_bfd (objdump.c:3653) ==105891== by 0x40AC63: display_file (objdump.c:3674) ==105891== by 0x404CBD: main (objdump.c:3969) ==105891== ==105891== Invalid read of size 8 ==105891== at 0x4C2F790: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==105891== by 0x425034: memcpy (string3.h:51) ==105891== by 0x425034: savestring (stabs.c:217) ==105891== by 0x4283F7: parse_stab_enum_type (stabs.c:1981) ==105891== by 0x4283F7: parse_stab_type (stabs.c:1554) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x427B12: parse_stab_type (stabs.c:1369) ==105891== by 0x42AE36: parse_stab_string (stabs.c:815) ==105891== by 0x42AE36: parse_stab (stabs.c:651) ==105891== by 0x4214EC: read_symbol_stabs_debugging_info (rddbg.c:321) ==105891== by 0x4214EC: read_debugging_info (rddbg.c:62) ==105891== Address 0x5411f68 is 8 bytes after a block of size 256 alloc'd ==105891== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==105891== by 0x449F9D: bfd_malloc (libbfd.c:184) ==105891== by 0x49CB82: aout_get_external_symbols (aoutx.h:1359) ==105891== by 0x4A03F8: aout_32_slurp_symbol_table (aoutx.h:1755) ==105891== by 0x4A1628: aout_32_get_symtab_upper_bound (aoutx.h:2520) ==105891== by 0x407DB2: slurp_symtab (objdump.c:611) ==105891== by 0x407DB2: dump_bfd (objdump.c:3476) ==105891== by 0x4089AF: display_object_bfd (objdump.c:3564) ==105891== by 0x4089AF: display_any_bfd (objdump.c:3653) ==105891== by 0x40AC63: display_file (objdump.c:3674) ==105891== by 0x404CBD: main (objdump.c:3969) ASAN says: ==122274==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000009c40 at pc 0x6ca71e bp 0x7ffd26801c10 sp 0x7ffd26801c08 READ of size 1 at 0x611000009c40 thread T0 #0 0x6ca71d in parse_stab_enum_type /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1978 #1 0x6bc4e1 in parse_stab_type /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1554 #2 0x6b9a33 in parse_stab_type /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1370 #3 0x6b9a33 in parse_stab_type /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1370 #4 0x6b9a33 in parse_stab_type /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1370 #5 0x6b9a33 in parse_stab_type /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1370 #6 0x6b9a33 in parse_stab_type /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1370 #7 0x6b9a33 in parse_stab_type /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1370 #8 0x6b9a33 in parse_stab_type /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:1370 #9 0x6adcfc in parse_stab_string /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:815 #10 0x6a6fa8 in parse_stab /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/stabs.c:651 #11 0x621eb4 in read_symbol_stabs_debugging_info /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/rddbg.c:321 #12 0x61aecd in read_debugging_info /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/rddbg.c:62 #13 0x498f7b in dump_bfd /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/objdump.c:3513 #14 0x4978fb in display_object_bfd /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/objdump.c:3564 #15 0x497698 in display_any_bfd /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/objdump.c:3653 #16 0x495ebe in display_file /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/objdump.c:3674 #17 0x493edd in main /home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/../../binutils/objdump.c:3969 #18 0x7fa29e80ef44 (/lib/x86_64-linux-gnu/libc.so.6+0x21f44) #19 0x48c95c in _start (/home/ubuntu/thesis/subjects/binutils-gdb-nick/build-asan/binutils/objdump+0x48c95c)