Bug 21587

Summary: global-buffer-overflow in rx_decode_opcode
Product: binutils Reporter: Alexandre Adamski <aadamski>
Component: binutilsAssignee: Not yet assigned to anyone <unassigned>
Status: RESOLVED FIXED    
Severity: normal CC: nickc
Priority: P2    
Version: 2.29   
Target Milestone: ---   
Host: Target:
Build: Last reconfirmed:
Attachments: testcase
report

Description Alexandre Adamski 2017-06-13 21:03:08 UTC
Hello there,

I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the
ASAN report log ("Output"). Below is the reduced stacktrace with links to the
corresponding source lines on a GitHub mirror.

The command I used was `objdump -D <file>`.

Let me know if there is any additional information I can provide.

--

Input: 9ed130cf25d8df5207cad7fc0de4fc1f.109246746a4907b00292c7837b29f085.min
Output: 9ed130cf25d8df5207cad7fc0de4fc1f.109246746a4907b00292c7837b29f085.txt

Error in "rx_decode_opcode": global-buffer-overflow
  in rx_decode_opcode at opcodes/rx-decode.opc:288
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/rx-decode.opc#L288)
  in print_insn_rx at opcodes/rx-dis.c:123
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/rx-dis.c#L123)
  in disassemble_bytes at binutils/objdump.c:1864
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L1864)
  in disassemble_section at binutils/objdump.c:2309
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2309)
  in bfd_map_over_sections at bfd/section.c:1395
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/section.c#L1395)
  in disassemble_data at binutils/objdump.c:2445
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2445)
  in dump_bfd at binutils/objdump.c:3547
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3547)
  in display_file at binutils/objdump.c:3714
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
  in main at binutils/objdump.c:4016
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)
Comment 1 Alexandre Adamski 2017-06-13 21:03:25 UTC
Created attachment 10120 [details]
testcase
Comment 2 Alexandre Adamski 2017-06-13 21:03:38 UTC
Created attachment 10121 [details]
report
Comment 3 Alexandre Adamski 2017-06-13 22:35:48 UTC
Additional Information:
The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.
Comment 4 cvs-commit@gcc.gnu.org 2017-06-14 12:36:25 UTC
The master branch has been updated by Nick Clifton <nickc@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=db5fa770268baf8cc82cf9b141d69799fd485fe2

commit db5fa770268baf8cc82cf9b141d69799fd485fe2
Author: Nick Clifton <nickc@redhat.com>
Date:   Wed Jun 14 13:35:06 2017 +0100

    Fix address violation problems when disassembling a corrupt RX binary.
    
    	PR binutils/21587
    	* rx-decode.opc: Include libiberty.h
    	(GET_SCALE): New macro - validates access to SCALE array.
    	(GET_PSCALE): New macro - validates access to PSCALE array.
    	(DIs, SIs, S2Is, rx_disp): Use new macros.
    	* rx-decode.c: Regenerate.
Comment 5 Nick Clifton 2017-06-14 12:38:57 UTC
Hi Aadamski,

  Thanks for reporting this problem.

  I have checked in a patch to add some more checks to the RX disassembler.

Cheers
  Nick