Bug 21578 - global-buffer-overflow in sh_elf_set_mach_from_flags
Summary: global-buffer-overflow in sh_elf_set_mach_from_flags
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.29
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
Depends on:
Reported: 2017-06-13 17:42 UTC by Alexandre Adamski
Modified: 2017-06-17 12:02 UTC (History)
1 user (show)

See Also:
Last reconfirmed:

testcase (44 bytes, application/octet-stream)
2017-06-13 17:42 UTC, Alexandre Adamski
report (967 bytes, text/plain)
2017-06-13 17:43 UTC, Alexandre Adamski

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandre Adamski 2017-06-13 17:42:37 UTC
Hello there,

I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the
ASAN report log ("Output"). Below is the reduced stacktrace with links to the
corresponding source lines on a GitHub mirror.

The command I used was `objdump -D <file>`.

Let me know if there is any additional information I can provide.


Input: c24647613dbe4980271152483669f8a8.7ee780ea2ec4990cf7a4d67b77bb9114.min
Output: c24647613dbe4980271152483669f8a8.7ee780ea2ec4990cf7a4d67b77bb9114.txt

Error in "sh_elf_set_mach_from_flags": global-buffer-overflow
  in sh_elf_set_mach_from_flags at bfd/elf32-sh.c:6350
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/elf32-sh.c#L6350)
  in sh_elf_object_p at bfd/elf32-sh.c:6514
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/elf32-sh.c#L6514)
  in bfd_elf32_object_p at bfd/elfcode.h:817
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/elfcode.h#L817)
  in bfd_check_format_matches at bfd/format.c:311
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/format.c#L311)
  in display_object_bfd at binutils/objdump.c:3602
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3602)
  in display_any_bfd at binutils/objdump.c:3693
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3693)
  in display_file at binutils/objdump.c:3714
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
  in main at binutils/objdump.c:4016
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)
Comment 1 Alexandre Adamski 2017-06-13 17:42:56 UTC
Created attachment 10102 [details]
Comment 2 Alexandre Adamski 2017-06-13 17:43:14 UTC
Created attachment 10103 [details]
Comment 3 Alexandre Adamski 2017-06-13 22:37:29 UTC
Additional Information:
The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.
Comment 4 Sourceware Commits 2017-06-14 16:02:55 UTC
The master branch has been updated by Nick Clifton <nickc@sourceware.org>:


commit f461bbd847f15657f3dd2f317c30c75a7520da1f
Author: Nick Clifton <nickc@redhat.com>
Date:   Wed Jun 14 17:01:54 2017 +0100

    Fix address violation bug when disassembling a corrupt SH binary.
    	PR binutils/21578
    	* elf32-sh.c (sh_elf_set_mach_from_flags): Fix check for invalid
    	flag value.
Comment 5 Nick Clifton 2017-06-14 16:04:08 UTC
Hi Aadamski,

  Thanks for reporting this bug.  This was simple one - a check to make sure
  that an array access was valid was using the wrong size.  I have checked in
  a patch to fix it.

Comment 6 Alexandre Adamski 2017-06-17 12:02:24 UTC
Alright. Changing the status to FIXED.