| Summary: | heap-buffer-overflow in bfd_getl64 | ||
|---|---|---|---|
| Product: | binutils | Reporter: | Alexandre Adamski <aadamski> |
| Component: | binutils | Assignee: | Not yet assigned to anyone <unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | nickc |
| Priority: | P2 | ||
| Version: | 2.29 | ||
| Target Milestone: | --- | ||
| Host: | Target: | ||
| Build: | Last reconfirmed: | ||
| Attachments: |
testcase
report |
||
Created attachment 10124 [details]
testcase
Created attachment 10125 [details]
report
Additional Information: The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`. The master branch has been updated by Nick Clifton <nickc@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=c53d2e6d744da000aaafe0237bced090aab62818 commit c53d2e6d744da000aaafe0237bced090aab62818 Author: Nick Clifton <nickc@redhat.com> Date: Wed Jun 14 11:27:15 2017 +0100 Fix potential address violations when processing a corrupt Alpha VMA binary. PR binutils/21589 * vms-alpha.c (_bfd_vms_get_value): Add an extra parameter - the maximum value for the ascic pointer. Check that name processing does not read beyond this value. (_bfd_vms_slurp_etir): Add checks for attempts to read beyond the end of etir record. Hi Aadamski, Thanks for reporting this bug. There were several places in the VMS parsing code where potential address violations could happen. I have checked in a patch which I hope will address them all. Cheers Nick |
Hello there, I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer. Please find attached the minimized file causing the issue ("Input") and the ASAN report log ("Output"). Below is the reduced stacktrace with links to the corresponding source lines on a GitHub mirror. The command I used was `objdump -D <file>`. Let me know if there is any additional information I can provide. -- Input: b191ee11c7169200988c060adca76c38.cacb6ad748b0dfa298c700c498a0a304.min Output: b191ee11c7169200988c060adca76c38.cacb6ad748b0dfa298c700c498a0a304.txt Error in "bfd_getl64": heap-buffer-overflow in bfd_getl64 at bfd/libbfd.c:620 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/libbfd.c#L620) in _bfd_vms_slurp_etir at bfd/vms-alpha.c:1768 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/vms-alpha.c#L1768) in vms_slurp_debug at bfd/vms-alpha.c:2307 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/vms-alpha.c#L2307) in _bfd_vms_slurp_etbt at bfd/vms-alpha.c:2337 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/vms-alpha.c#L2337) in _bfd_vms_slurp_object_records at bfd/vms-alpha.c:2409 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/vms-alpha.c#L2409) in alpha_vms_object_p at bfd/vms-alpha.c:2584 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/vms-alpha.c#L2584) in bfd_check_format_matches at bfd/format.c:311 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/format.c#L311) in display_object_bfd at binutils/objdump.c:3602 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3602) in display_any_bfd at binutils/objdump.c:3693 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3693) in display_file at binutils/objdump.c:3714 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714) in main at binutils/objdump.c:4016 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)