Bug 21581

Summary: stack-buffer-overflow in bfd_get_string
Product: binutils Reporter: Alexandre Adamski <aadamski>
Component: binutilsAssignee: Not yet assigned to anyone <unassigned>
Status: RESOLVED FIXED    
Severity: normal CC: nickc
Priority: P2    
Version: 2.29   
Target Milestone: ---   
Host: Target:
Build: Last reconfirmed:
Attachments: testcase
report

Description Alexandre Adamski 2017-06-13 17:51:28 UTC
Hello there,

I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the
ASAN report log ("Output"). Below is the reduced stacktrace with links to the
corresponding source lines on a GitHub mirror.

The command I used was `objdump -D <file>`.

Let me know if there is any additional information I can provide.

--

Input: 02d8fa874391d563ccfd5911ff5f5cf8.fe651c9b03ff955c157ecee745208476.min
Output: 02d8fa874391d563ccfd5911ff5f5cf8.fe651c9b03ff955c157ecee745208476.txt

Error in "bfd_get_string": stack-buffer-overflow
  in bfd_get_string at bfd/ieee.c:198
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/ieee.c#L198)
  in read_id at bfd/ieee.c:227
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/ieee.c#L227)
  in ieee_object_p at bfd/ieee.c:1907
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/ieee.c#L1907)
  in bfd_check_format_matches at bfd/format.c:311
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/format.c#L311)
  in display_object_bfd at binutils/objdump.c:3602
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3602)
  in display_any_bfd at binutils/objdump.c:3693
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3693)
  in display_file at binutils/objdump.c:3714
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
  in main at binutils/objdump.c:4016
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)
Comment 1 Alexandre Adamski 2017-06-13 17:51:58 UTC
Created attachment 10112 [details]
testcase
Comment 2 Alexandre Adamski 2017-06-13 17:52:16 UTC
Created attachment 10113 [details]
report
Comment 3 Alexandre Adamski 2017-06-13 22:40:12 UTC
Additional Information:
The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.
Comment 4 Alexandre Adamski 2017-06-14 14:52:52 UTC
(In reply to Nick Clifton from comment #4)
>   Are you able to test out patches and see if they make a difference ?  If so
>   please could you try out the uploaded patch which might make a difference.
>   For me, the bug goes away, but I cannot tell if I have really fixed the
>   problem, or if there is still some kind of stack corruption going on.

I tried your patch with both the raw and the minimized testcases; it seems not to crash anymore. I have started an instance of AFL in "crash exploration" mode in order to generate more diverse testcases. I will report back in a few hours.

Thanks a lot for all your bug fixes, you're doing god's work! :-)
Comment 5 cvs-commit@gcc.gnu.org 2017-06-15 12:10:02 UTC
The master branch has been updated by Nick Clifton <nickc@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=62b76e4b6e0b4cb5b3e0053d1de4097b32577049

commit 62b76e4b6e0b4cb5b3e0053d1de4097b32577049
Author: Nick Clifton <nickc@redhat.com>
Date:   Thu Jun 15 13:08:47 2017 +0100

    Fix address violation parsing a corrupt ieee binary.
    
    	PR binutils/21581
    	(ieee_archive_p): Use a static buffer to avoid compiler bugs.
Comment 6 Nick Clifton 2017-06-15 12:11:14 UTC
Hi Aadamski,

  Thanks for reporting this bug.  The problem is the same as PR 21582 except
  that it is happening in the archive handling part of the IEEE scanning code.
  I have checked in a similar fix.

Cheers
  Nick