Bug 21580

Summary: heap-buffer-overflow in disassemble_bytes
Product: binutils Reporter: Alexandre Adamski <aadamski>
Component: binutilsAssignee: Not yet assigned to anyone <unassigned>
Status: RESOLVED FIXED    
Severity: normal CC: nickc
Priority: P2    
Version: 2.29   
Target Milestone: ---   
Host: Target:
Build: Last reconfirmed:
Attachments: testcase_37a2b
report_37a2b
testcase_77125
report_77125
testcase_c3269
report_c3269

Description Alexandre Adamski 2017-06-13 17:46:48 UTC
Hello there,

I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the
ASAN report log ("Output"). Below is the reduced stacktrace with links to the
corresponding source lines on a GitHub mirror.

The command I used was `objdump -D <file>`.

Let me know if there is any additional information I can provide.

--

Input: 37a2b1374545eb23eed0eea880de6226.ad5cda09828cea9d238db2184e95406b.min
Output: 37a2b1374545eb23eed0eea880de6226.ad5cda09828cea9d238db2184e95406b.txt

Error in "disassemble_bytes": heap-buffer-overflow
  in disassemble_bytes at binutils/objdump.c:1993
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L1993)
  in disassemble_section at binutils/objdump.c:2309
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2309)
  in bfd_map_over_sections at bfd/section.c:1395
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/section.c#L1395)
  in disassemble_data at binutils/objdump.c:2445
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2445)
  in dump_bfd at binutils/objdump.c:3547
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3547)
  in display_file at binutils/objdump.c:3714
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
  in main at binutils/objdump.c:4016
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)

Input: 77125fccb44694b0db18006db1f0f4d3.64e76dd7ab33d15c8293caeca73c704a.min
Output: 77125fccb44694b0db18006db1f0f4d3.64e76dd7ab33d15c8293caeca73c704a.txt

Error in "disassemble_bytes": heap-buffer-overflow
  in disassemble_bytes at binutils/objdump.c:1932
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L1932)
  in disassemble_section at binutils/objdump.c:2309
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2309)
  in bfd_map_over_sections at bfd/section.c:1395
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/section.c#L1395)
  in disassemble_data at binutils/objdump.c:2445
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2445)
  in dump_bfd at binutils/objdump.c:3547
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3547)
  in display_file at binutils/objdump.c:3714
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
  in main at binutils/objdump.c:4016
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)

Input: c3269b8eae3f3ec0001d835e66795702.6e6557284eb14f91acf6c2576396517c.min
Output: c3269b8eae3f3ec0001d835e66795702.6e6557284eb14f91acf6c2576396517c.txt

Error in "disassemble_bytes": heap-buffer-overflow
  in disassemble_bytes at binutils/objdump.c:1926
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L1926)
  in disassemble_section at binutils/objdump.c:2309
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2309)
  in bfd_map_over_sections at bfd/section.c:1395
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/section.c#L1395)
  in disassemble_data at binutils/objdump.c:2445
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2445)
  in dump_bfd at binutils/objdump.c:3547
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3547)
  in display_file at binutils/objdump.c:3714
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
  in main at binutils/objdump.c:4016
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)
Comment 1 Alexandre Adamski 2017-06-13 17:47:46 UTC
Created attachment 10106 [details]
testcase_37a2b
Comment 2 Alexandre Adamski 2017-06-13 17:48:04 UTC
Created attachment 10107 [details]
report_37a2b
Comment 3 Alexandre Adamski 2017-06-13 17:49:12 UTC
Created attachment 10108 [details]
testcase_77125
Comment 4 Alexandre Adamski 2017-06-13 17:49:32 UTC
Created attachment 10109 [details]
report_77125
Comment 5 Alexandre Adamski 2017-06-13 17:50:02 UTC
Created attachment 10110 [details]
testcase_c3269
Comment 6 Alexandre Adamski 2017-06-13 17:50:46 UTC
Created attachment 10111 [details]
report_c3269
Comment 7 Alexandre Adamski 2017-06-13 22:37:06 UTC
Additional Information:
The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.
Comment 8 Alexandre Adamski 2017-06-14 14:53:23 UTC
(In reply to Nick Clifton from comment #4)
>   Are you able to test out patches and see if they make a difference ?  If so
>   please could you try out the uploaded patch which might make a difference.
>   For me, the bug goes away, but I cannot tell if I have really fixed the
>   problem, or if there is still some kind of stack corruption going on.

I tried your patch with both the raw and the minimized testcases; it seems not to crash anymore. I have started an instance of AFL in "crash exploration" mode in order to generate more diverse testcases. I will report back in a few hours.

Thanks a lot for all your bug fixes, you're doing god's work! :-)
Comment 9 cvs-commit@gcc.gnu.org 2017-06-14 15:51:24 UTC
The master branch has been updated by Nick Clifton <nickc@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ae87f7e73eba29bd38b3a9684a10b948ed715612

commit ae87f7e73eba29bd38b3a9684a10b948ed715612
Author: Nick Clifton <nickc@redhat.com>
Date:   Wed Jun 14 16:50:03 2017 +0100

    Fix address violation when disassembling a corrupt binary.
    
    	PR binutils/21580
    binutils * objdump.c (disassemble_bytes): Check for buffer overrun when
    	printing out rae insns.
    
    ld	* testsuite/ld-nds32/diff.d: Adjust expected output.
Comment 10 Nick Clifton 2017-06-14 15:52:40 UTC
Hi Aadamski,

  Thanks for reporting this bug.

  The problem was a buffer overrun when printing out the raw bytes involved
  in the disassembly.  I have checked in a fix to prevent this from happening
  so all should be well now.

Cheers
  Nick