Dear All, This bug was found with AFLGo, a directed version of AFL/AFLFast. Thanks also to Marcel Böhme and Van-Thuan Pham. This bug was found on Ubuntu 14.04 64-bit & binutils was checked out from main repository at git://sourceware.org/git/binutils-gdb.git. Its commit is a6c21d4a553de184562fd8409a5bcd3f2cc2561a (Wed Apr 19 13:16:05 2017). binutils was built with ASAN using gcc-6.2 and clang-3.4. The configure command was: CC=clang CFLAGS="-DFORTIFY_SOURCE=2 -fstack-protector-all -fsanitize=undefined,address -fno-omit-frame-pointer -g -Wno-error" ../configure --disable-shared --disable-gdb --disable-libdecnumber --disable-readline --disable-sim To reproduce: Download the attached file - bug_11 objcopy -Gs bug_11 ASAN says: ../../binutils/objcopy.c:1555:52: runtime error: member access within null pointer of type 'struct bfd_symbol' ASAN:SIGSEGV ================================================================= ==149416==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x00000051cdca bp 0x7ffec2588b50 sp 0x7ffec2588100 T0) #0 0x51cdc9 in filter_symbols /home/ubuntu/binutils-analysis/binutils-gdb/obj-asan/binutils/../../binutils/objcopy.c:1553:16 #1 0x501ddb in copy_object /home/ubuntu/binutils-analysis/binutils-gdb/obj-asan/binutils/../../binutils/objcopy.c:2840:18 #2 0x4ebe2c in copy_file /home/ubuntu/binutils-analysis/binutils-gdb/obj-asan/binutils/../../binutils/objcopy.c:3333:13 #3 0x4d6716 in copy_main /home/ubuntu/binutils-analysis/binutils-gdb/obj-asan/binutils/../../binutils/objcopy.c:5266:3 #4 0x4cac8a in main /home/ubuntu/binutils-analysis/binutils-gdb/obj-asan/binutils/../../binutils/objcopy.c:5367:5 #5 0x7fbb012eff44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287 #6 0x4ca31c in _start (/home/ubuntu/binutils-analysis/binutils-gdb/obj-asan/binutils/objcopy+0x4ca31c) VALGRIND says: ==148414== Invalid read of size 4 ==148414== at 0x404481: filter_symbols (objcopy.c:1555) ==148414== by 0x4077D5: copy_object (objcopy.c:2840) ==148414== by 0x408AED: copy_file (objcopy.c:3333) ==148414== by 0x40C8B8: copy_main (objcopy.c:5266) ==148414== by 0x40CBE5: main (objcopy.c:5367) ==148414== Address 0x18 is not stack'd, malloc'd or (recently) free'd ==148414== ==148414== ==148414== Process terminating with default action of signal 11 (SIGSEGV) ==148414== Access not within mapped region at address 0x18 ==148414== at 0x404481: filter_symbols (objcopy.c:1555) ==148414== by 0x4077D5: copy_object (objcopy.c:2840) ==148414== by 0x408AED: copy_file (objcopy.c:3333) ==148414== by 0x40C8B8: copy_main (objcopy.c:5266) ==148414== by 0x40CBE5: main (objcopy.c:5367)
Created attachment 10011 [details] Crashing input
The master branch has been updated by Alan Modra <amodra@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7eacd66b086cabb1daab20890d5481894d4f56b2 commit 7eacd66b086cabb1daab20890d5481894d4f56b2 Author: Alan Modra <amodra@gmail.com> Date: Sun Apr 23 15:21:11 2017 +0930 PR 21414, null pointer deref of _bfd_elf_large_com_section sym PR 21414 * section.c (GLOBAL_SYM_INIT): Make available in bfd.h. * elf.c (lcomm_sym): New. (_bfd_elf_large_com_section): Use lcomm_sym section symbol. * bfd-in2.h: Regenerate.
Fixed
Thanks Alan Modra. This is CVE-2017-8394.