Bug 20895 - AS: Assertion violation when resolving symbol data
Summary: AS: Assertion violation when resolving symbol data
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: ld (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-12-01 10:26 UTC by Marcel Böhme
Modified: 2016-12-01 10:42 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel Böhme 2016-12-01 10:26:32 UTC 
Dear all,

The assembler 'as' in Binutils trunk reports an internal error for the following execution.

The bug was found with AFLFast, a fork of AFL. Thanks also to Van-Thuan Pham.

How to reproduce:
printf "\x82\x30\x30\x30\x30\x30\x30\x30\x30\x00\x4b\x3d\x3d\x4b\x3d\x3d\x55\x00\x00\x80\x30\x20\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\xff\x30\x00\x00\x8f\x00\x00\x00\x00\x00\xbf\x30\x30\x30\x00\x3d\x30\x00\xff\x30\x30\x00\x4b\x3d\x30\x30\x30\x30\x30\x30\x30\x30\x00\x00\x8f\x00\x00\x00\x00\x00\xbf\x30\x30\x30\x00\x3d\x30\x00\xff\x30\x30\x00\x4b\x30\x3d\xbd\x3d\x00\x00\x4b\x3d\x3d\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x40" > a

$ as a
...
a: Internal error, aborting at ../../gas/symbols.c:1432 in resolve_symbol_value
Please report this bug.

The assertion violation was confirmed for trunk, v2.26.1 but not for v2.24.

Best regards,
- Marcel
Comment 1 Sourceware Commits 2016-12-01 10:39:53 UTC 
The master branch has been updated by Nick Clifton <nickc@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6d6ad65b43efa17a825702297331fcb290445a18

commit 6d6ad65b43efa17a825702297331fcb290445a18
Author: Nick Clifton <nickc@redhat.com>
Date:   Thu Dec 1 10:38:40 2016 +0000

    Fix ICE in assembler when passed a corrupt input file.
    
    	PR gas/20895
    	* symbols.c (resolve_symbol_value): Gracefully handle erroneous
    	symbolic expressions.
Comment 2 Nick Clifton 2016-12-01 10:42:07 UTC 
Hi Marcel (and Van-Thuan)

  Thanks for reporting this bug.  I have checked in a small patch to the assembler which replaces the call to abort (which results in the internal error message) with an more helpful error message.

Cheers
  Nick

PS.  For future reference it helps if you can tell us the target architecture for which you built the assembler (or other binutils)...