| Summary: | heap-buffer-overflow in add_symbol | ||
|---|---|---|---|
| Product: | binutils | Reporter: | Alexandre Adamski <aadamski> |
| Component: | binutils | Assignee: | Not yet assigned to anyone <unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | amodra, nickc |
| Priority: | P2 | ||
| Version: | 2.29 | ||
| Target Milestone: | --- | ||
| Host: | Target: | ||
| Build: | Last reconfirmed: | ||
| Attachments: |
282cc553a70cccddc4535d4bb3db5692.6a1a70e215d3fd538023ab8e5737b3c8.min
282cc553a70cccddc4535d4bb3db5692.6a1a70e215d3fd538023ab8e5737b3c8.txt 5deafefa1ca077a686a06b18e93f6e2e.484ddbe005142cc897588a715f2572f7.min 5deafefa1ca077a686a06b18e93f6e2e.484ddbe005142cc897588a715f2572f7.txt |
||
Created attachment 10204 [details]
282cc553a70cccddc4535d4bb3db5692.6a1a70e215d3fd538023ab8e5737b3c8.min
Created attachment 10205 [details]
282cc553a70cccddc4535d4bb3db5692.6a1a70e215d3fd538023ab8e5737b3c8.txt
Created attachment 10206 [details]
5deafefa1ca077a686a06b18e93f6e2e.484ddbe005142cc897588a715f2572f7.min
Created attachment 10207 [details]
5deafefa1ca077a686a06b18e93f6e2e.484ddbe005142cc897588a715f2572f7.txt
Hi Alexandre, I cannot reproduce these failures - either of them. Please could you check to see if they have already been fixed, and if so, close this PR. Cheers Nick Both testcases no longer result in overflows on current 2.29 or master. Both fail with 2.28. |
Hello there, I have been fuzzing objdump with American Fuzzy Lop + ASAN/UBSAN. Please find attached the minimized file causing the issue ("Input") and the ASAN report log ("Output"). Below is the reduced stacktrace with links to the corresponding source lines on a GitHub mirror. The configuration settings used were `--enable-targets=all --disable-shared`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=all`. The command used was `objdump -afpxDSsgetTrR <file>`. Let me know if there is any additional information I can provide. -- Input: 282cc553a70cccddc4535d4bb3db5692.6a1a70e215d3fd538023ab8e5737b3c8.min Output: 282cc553a70cccddc4535d4bb3db5692.6a1a70e215d3fd538023ab8e5737b3c8.txt Error in "add_symbol": heap-buffer-overflow in add_symbol at bfd/vms-alpha.c:1125 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/bfd/vms-alpha.c#L1125) in _bfd_vms_slurp_egsd at bfd/vms-alpha.c:1307 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/bfd/vms-alpha.c#L1307) in _bfd_vms_slurp_object_records at bfd/vms-alpha.c:2456 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/bfd/vms-alpha.c#L2456) in alpha_vms_object_p at bfd/vms-alpha.c:2640 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/bfd/vms-alpha.c#L2640) in bfd_check_format_matches at bfd/format.c:311 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/bfd/format.c#L311) in display_object_bfd at binutils/objdump.c:3608 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/binutils/objdump.c#L3608) in display_any_bfd at binutils/objdump.c:3699 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/binutils/objdump.c#L3699) in display_file at binutils/objdump.c:3720 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/binutils/objdump.c#L3720) in main at binutils/objdump.c:4024 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/binutils/objdump.c#L4024) Input: 5deafefa1ca077a686a06b18e93f6e2e.484ddbe005142cc897588a715f2572f7.min Output: 5deafefa1ca077a686a06b18e93f6e2e.484ddbe005142cc897588a715f2572f7.txt Error in "add_symbol": heap-buffer-overflow in add_symbol at bfd/vms-alpha.c:1120 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/bfd/vms-alpha.c#L1120) in _bfd_vms_slurp_egsd at bfd/vms-alpha.c:1265 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/bfd/vms-alpha.c#L1265) in _bfd_vms_slurp_object_records at bfd/vms-alpha.c:2456 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/bfd/vms-alpha.c#L2456) in alpha_vms_object_p at bfd/vms-alpha.c:2640 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/bfd/vms-alpha.c#L2640) in bfd_check_format_matches at bfd/format.c:311 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/bfd/format.c#L311) in display_object_bfd at binutils/objdump.c:3608 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/binutils/objdump.c#L3608) in display_any_bfd at binutils/objdump.c:3699 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/binutils/objdump.c#L3699) in display_file at binutils/objdump.c:3720 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/binutils/objdump.c#L3720) in main at binutils/objdump.c:4024 (see https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/binutils/objdump.c#L4024)