Bug 20439 - readelf crashes in dwarf implementation
Summary: readelf crashes in dwarf implementation
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.28
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-05 14:42 UTC by Markus
Modified: 2016-08-08 08:36 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
Project(s) to access:
ssh public key:

Attachments
readelf -a -g -n -u -wlLiaprmfFsoRt (27.87 KB, application/zip)
2016-08-05 14:42 UTC, Markus 		Details
Proposed patch (948 bytes, patch)
2016-08-05 17:48 UTC, Nick Clifton 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Markus 2016-08-05 14:42:52 UTC 
Created attachment 9422 [details]
readelf -a -g -n -u -wlLiaprmfFsoRt

Affected Versions: <= 2.28 (HEAD)
Tested system: Ubuntu 14.04LTS 64-bit
Binary: readelf, 32-bit compiled (ASAN)
Params: -a -g -n -u -wlLiaprmfFsoRt

Hi,
several crashes found during fuzzing in the dwarf implementation.

Affected functions (dwarf.c):
display_debug_lines_decoded()
display_debug_frames()
frame_display_row()
Comment 1 Nick Clifton 2016-08-05 17:48:52 UTC 
Created attachment 9424 [details]
Proposed patch

Hi Markus,

  Thanks for reporting this bug.

  I am currently trying the uploaded patch locally, and so far it is looking good.
  If it turns out that there are no regressions I will apply it on Monday.

Cheers
  Nick
Comment 2 Sourceware Commits 2016-08-08 08:35:55 UTC 
The master branch has been updated by Nick Clifton <nickc@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=db9537d2b735300b129e2715012ae249ee015f58

commit db9537d2b735300b129e2715012ae249ee015f58
Author: Nick Clifton <nickc@redhat.com>
Date:   Mon Aug 8 09:34:32 2016 +0100

    Fix seg-fault in DWARF dumper when given a corrupt binary containing illegal directory and file table indicies.
    
    	PR binutils/20439
    	* dwarf.c (display_debug_lines_decoded): Check directory and file
    	indicies before using them to access directory and file tables.
Comment 3 Nick Clifton 2016-08-08 08:36:54 UTC 
There were a couple of off-by-one errors in the original patch, but I have now fixed these.