Hello there, I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer. Please find attached the minimized file causing the issue ("Input") and the ASAN report log ("Output"). Below is the reduced stacktrace with links to the corresponding source lines on a GitHub mirror. The command I used was `objdump -D <file>`. Let me know if there is any additional information I can provide. -- Input: ab844d92312902844f829a40c6120d02.3a4b9137927f7b20fe0700ff4a74fb54.min Output: ab844d92312902844f829a40c6120d02.3a4b9137927f7b20fe0700ff4a74fb54.txt Error in "_bfd_hexdump": heap-buffer-overflow in _bfd_hexdump at bfd/vms-misc.c:110 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/vms-misc.c#L110) in _bfd_vms_slurp_etir at bfd/vms-alpha.c:1741 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/vms-alpha.c#L1741) in vms_slurp_debug at bfd/vms-alpha.c:2307 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/vms-alpha.c#L2307) in _bfd_vms_slurp_edbg at bfd/vms-alpha.c:2324 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/vms-alpha.c#L2324) in _bfd_vms_slurp_object_records at bfd/vms-alpha.c:2406 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/vms-alpha.c#L2406) in alpha_vms_object_p at bfd/vms-alpha.c:2584 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/vms-alpha.c#L2584) in bfd_check_format_matches at bfd/format.c:311 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/format.c#L311) in display_object_bfd at binutils/objdump.c:3602 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3602) in display_any_bfd at binutils/objdump.c:3693 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3693) in display_file at binutils/objdump.c:3714 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714) in main at binutils/objdump.c:4016 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)
Created attachment 10104 [details] testcase
Created attachment 10105 [details] report
Additional Information: The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.
The master branch has been updated by Nick Clifton <nickc@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=76800cba595efc3fe95a446c2d664e42ae4ee869 commit 76800cba595efc3fe95a446c2d664e42ae4ee869 Author: Nick Clifton <nickc@redhat.com> Date: Thu Jun 15 12:08:57 2017 +0100 Handle EITR records in VMS Alpha binaries with overlarge command length parameters. PR binutils/21579 * vms-alpha.c (_bfd_vms_slurp_etir): Extend check of cmd_length.
Hi Adamski, Thanks for reporting this bug. It turns out that in was very similar to 21589, and the fix is almost identical. Cheers Nick