Bug 21582 - stack-buffer-overflow in ieee_object_p
Summary: stack-buffer-overflow in ieee_object_p
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.29
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-06-13 17:53 UTC by Alexandre Adamski
Modified: 2017-06-15 11:47 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments
testcase (11 bytes, application/octet-stream)
2017-06-13 17:53 UTC, Alexandre Adamski
Details
report (1.01 KB, text/plain)
2017-06-13 17:53 UTC, Alexandre Adamski
Details
Proposed patch (220 bytes, patch)
2017-06-14 14:14 UTC, Nick Clifton
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandre Adamski 2017-06-13 17:53:01 UTC
Hello there,

I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the
ASAN report log ("Output"). Below is the reduced stacktrace with links to the
corresponding source lines on a GitHub mirror.

The command I used was `objdump -D <file>`.

Let me know if there is any additional information I can provide.

--

Input: ef51bcdcaae667058b002f94b5dafd05.12926af7cc4fab77f87a3ec70a329100.min
Output: ef51bcdcaae667058b002f94b5dafd05.12926af7cc4fab77f87a3ec70a329100.txt

Error in "ieee_object_p": stack-buffer-overflow
  in ieee_object_p at bfd/ieee.c:1985
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/ieee.c#L1985)
  in bfd_check_format_matches at bfd/format.c:311
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/format.c#L311)
  in display_object_bfd at binutils/objdump.c:3602
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3602)
  in display_any_bfd at binutils/objdump.c:3693
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3693)
  in display_file at binutils/objdump.c:3714
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
  in main at binutils/objdump.c:4016
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)
Comment 1 Alexandre Adamski 2017-06-13 17:53:36 UTC
Created attachment 10114 [details]
testcase
Comment 2 Alexandre Adamski 2017-06-13 17:53:56 UTC
Created attachment 10115 [details]
report
Comment 3 Alexandre Adamski 2017-06-13 22:36:49 UTC
Additional Information:
The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.
Comment 4 Nick Clifton 2017-06-14 14:14:55 UTC
Created attachment 10139 [details]
Proposed patch

Hi Aadamski,

  This is a difficult one.  Although I can reproduce the problem, it goes away
  whenever I make changes to the sources, including just adding comments!  I
  suspect a compiler bug, but I cannot prove it at the moment.

  Are you able to test out patches and see if they make a difference ?  If so
  please could you try out the uploaded patch which might make a difference.
  For me, the bug goes away, but I cannot tell if I have really fixed the
  problem, or if there is still some kind of stack corruption going on.

Cheers
  Nick
Comment 5 Alexandre Adamski 2017-06-14 14:52:14 UTC
(In reply to Nick Clifton from comment #4)
>   Are you able to test out patches and see if they make a difference ?  If so
>   please could you try out the uploaded patch which might make a difference.
>   For me, the bug goes away, but I cannot tell if I have really fixed the
>   problem, or if there is still some kind of stack corruption going on.

I tried your patch with both the raw and the minimized testcases; it seems not to crash anymore. I have started an instance of AFL in "crash exploration" mode in order to generate more diverse testcases. I will report back in a few hours.

Thanks a lot for all your bug fixes, you're doing god's work! :-)
Comment 6 Alexandre Adamski 2017-06-15 09:55:33 UTC
Sounds like it's fixed for me!
Comment 7 cvs-commit@gcc.gnu.org 2017-06-15 11:45:37 UTC
The master branch has been updated by Nick Clifton <nickc@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=63634bb4a107877dd08b6282e28e11cfd1a1649e

commit 63634bb4a107877dd08b6282e28e11cfd1a1649e
Author: Nick Clifton <nickc@redhat.com>
Date:   Thu Jun 15 12:44:23 2017 +0100

    Avoid a possible compiler bug by using a static buffer instead of a stack local buffer.
    
    	PR binutils/21582
    	* ieee.c (ieee_object_p): Use a static buffer to avoid compiler
    	bugs.
Comment 8 Nick Clifton 2017-06-15 11:47:48 UTC
Hi Aadamski,

  Thanks for the confirmation - patch applied.

Cheers
  Nick