Bug 28753

Summary: Heap-based Buffer Overflow in bfd_getl32
Product: binutils Reporter: AiDai <wyxaidai>
Component: binutilsAssignee: Alan Modra <amodra>
Status: RESOLVED FIXED    
Severity: normal    
Priority: P2    
Version: 2.38   
Target Milestone: 2.38   
Host: Target:
Build: Last reconfirmed: 2022-01-20 00:00:00
Attachments: poc

Description AiDai 2022-01-08 07:57:50 UTC
Created attachment 13895 [details]
poc

```
./objdump -g poc

poc:     file format elf64-x86-64

./objdump: poc: invalid string offset 16711680 >= 6 for section `.strtab'
=================================================================
==3170153==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000011a at pc 0x0000006b2bba bp 0x7ffca4f16920 sp 0x7ffca4f16918
READ of size 1 at 0x60300000011a thread T0
    #0 0x6b2bb9 in bfd_getl32 /home/aidai/fuzzing/binutils/binutils-gdb/bfd/libbfd.c:729:24
    #1 0x5862c0 in read_section_stabs_debugging_info /home/aidai/fuzzing/binutils/binutils-gdb/binutils/rddbg.c:220:25
    #2 0x5862c0 in read_debugging_info /home/aidai/fuzzing/binutils/binutils-gdb/binutils/rddbg.c:56:9
    #3 0x4cef17 in dump_bfd /home/aidai/fuzzing/binutils/binutils-gdb/binutils/./objdump.c:5153:17
    #4 0x4ca155 in display_object_bfd /home/aidai/fuzzing/binutils/binutils-gdb/binutils/./objdump.c
    #5 0x4ca155 in display_any_bfd /home/aidai/fuzzing/binutils/binutils-gdb/binutils/./objdump.c:5299:5
    #6 0x4c9ce5 in display_file /home/aidai/fuzzing/binutils/binutils-gdb/binutils/./objdump.c:5320:3
    #7 0x4c74af in main /home/aidai/fuzzing/binutils/binutils-gdb/binutils/./objdump.c:5688:6
    #8 0x7f5ea20030b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #9 0x41c5ed in _start (/home/aidai/fuzzing/binutils/results/out-objdump-0102/objdump-fuzzer/crashes/objdump+0x41c5ed)

0x60300000011a is located 0 bytes to the right of 26-byte region [0x603000000100,0x60300000011a)
allocated by thread T0 here:
    #0 0x494d2d in malloc (/home/aidai/fuzzing/binutils/results/out-objdump-0102/objdump-fuzzer/crashes/objdump+0x494d2d)
    #1 0xa2008a in xmalloc /home/aidai/fuzzing/binutils/binutils-gdb/libiberty/./xmalloc.c:147:12
    #2 0x4cef17 in dump_bfd /home/aidai/fuzzing/binutils/binutils-gdb/binutils/./objdump.c:5153:17
    #3 0x4ca155 in display_object_bfd /home/aidai/fuzzing/binutils/binutils-gdb/binutils/./objdump.c
    #4 0x4ca155 in display_any_bfd /home/aidai/fuzzing/binutils/binutils-gdb/binutils/./objdump.c:5299:5
    #5 0x4c9ce5 in display_file /home/aidai/fuzzing/binutils/binutils-gdb/binutils/./objdump.c:5320:3

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/aidai/fuzzing/binutils/binutils-gdb/bfd/libbfd.c:729:24 in bfd_getl32
Shadow bytes around the buggy address:
  0x0c067fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff8000: fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa fd fd
  0x0c067fff8010: fd fa fa fa fd fd fd fa fa fa 00 00 00 fa fa fa
=>0x0c067fff8020: 00 00 00[02]fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3170153==ABORTING
Comment 1 Sourceware Commits 2022-01-28 06:32:18 UTC
The master branch has been updated by Alan Modra <amodra@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=085b299b71721e15f5c5c5344dc3e4e4536dadba

commit 085b299b71721e15f5c5c5344dc3e4e4536dadba
Author: Alan Modra <amodra@gmail.com>
Date:   Thu Jan 20 13:58:38 2022 +1030

    PR28753, buffer overflow in read_section_stabs_debugging_info
    
            PR 28753
            * rddbg.c (read_section_stabs_debugging_info): Don't read past
            end of section when concatentating stab strings.
Comment 2 Sourceware Commits 2022-02-05 08:29:40 UTC
The binutils-2_38-branch branch has been updated by Alan Modra <amodra@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=cad4d6b91e97b6962807d33c04ed7e7797788438

commit cad4d6b91e97b6962807d33c04ed7e7797788438
Author: Alan Modra <amodra@gmail.com>
Date:   Thu Jan 20 13:58:38 2022 +1030

    PR28753, buffer overflow in read_section_stabs_debugging_info
    
            PR 28753
            * rddbg.c (read_section_stabs_debugging_info): Don't read past
            end of section when concatentating stab strings.
    
    (cherry picked from commit 085b299b71721e15f5c5c5344dc3e4e4536dadba)
Comment 3 Alan Modra 2022-02-09 11:12:09 UTC
Fixed mainline and 2.38 branch