Bug 21577 - global-buffer-overflow in print_insn_score32
Summary: global-buffer-overflow in print_insn_score32
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.29
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
Depends on:
Reported: 2017-06-13 17:40 UTC by Alexandre Adamski
Modified: 2017-06-17 12:13 UTC (History)
1 user (show)

See Also:
Last reconfirmed:

testcase (73 bytes, application/octet-stream)
2017-06-13 17:41 UTC, Alexandre Adamski
report (939 bytes, text/plain)
2017-06-13 17:41 UTC, Alexandre Adamski

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandre Adamski 2017-06-13 17:40:50 UTC
Hello there,

I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the
ASAN report log ("Output"). Below is the reduced stacktrace with links to the
corresponding source lines on a GitHub mirror.

The command I used was `objdump -D <file>`.

Let me know if there is any additional information I can provide.


Input: a65be7164e5a90ce05dcf4432c700872.c1ea00d196d861eace6d10c5a95589d9.min
Output: a65be7164e5a90ce05dcf4432c700872.c1ea00d196d861eace6d10c5a95589d9.txt

Error in "print_insn_score32": global-buffer-overflow
  in print_insn_score32 at opcodes/score7-dis.c:552
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/score7-dis.c#L552)
  in s7_print_insn at opcodes/score7-dis.c:965
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/score7-dis.c#L965)
  in disassemble_bytes at binutils/objdump.c:1864
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L1864)
  in disassemble_section at binutils/objdump.c:2309
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2309)
  in bfd_map_over_sections at bfd/section.c:1395
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/section.c#L1395)
  in disassemble_data at binutils/objdump.c:2445
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2445)
  in dump_bfd at binutils/objdump.c:3547
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3547)
  in display_file at binutils/objdump.c:3714
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
  in main at binutils/objdump.c:4016
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)
Comment 1 Alexandre Adamski 2017-06-13 17:41:12 UTC
Created attachment 10100 [details]
Comment 2 Alexandre Adamski 2017-06-13 17:41:29 UTC
Created attachment 10101 [details]
Comment 3 Alexandre Adamski 2017-06-13 22:40:51 UTC
Additional Information:
The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.
Comment 4 Nick Clifton 2017-06-15 11:14:04 UTC
Hi Aadamski,

  I could not reproduce this failure.  Please could you check again to see
  if it is still present ?  I suspect that one of the recent patches to fix
  the other problems you detected may have fixed this problem as well.

Comment 5 Alexandre Adamski 2017-06-17 12:13:04 UTC
Can't reproduce it either, probably fixed. Changing status...