Hello there, I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer. Please find attached the minimized file causing the issue ("Input") and the ASAN report log ("Output"). Below is the reduced stacktrace with links to the corresponding source lines on a GitHub mirror. The command I used was `objdump -D <file>`. Let me know if there is any additional information I can provide. -- Input: 03ee135139d8cc43f9282e5a5d68a019.02b2e509a71e4909a73a734d69f2f503.min Output: 03ee135139d8cc43f9282e5a5d68a019.02b2e509a71e4909a73a734d69f2f503.txt Error in "rl78_decode_opcode": stack-buffer-overflow in rl78_decode_opcode at opcodes/rl78-decode.opc:190 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/rl78-decode.opc#L190) in print_insn_rl78_common at opcodes/rl78-dis.c:123 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/rl78-dis.c#L123) in disassemble_bytes at binutils/objdump.c:1864 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L1864) in disassemble_section at binutils/objdump.c:2309 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2309) in bfd_map_over_sections at bfd/section.c:1395 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/section.c#L1395) in disassemble_data at binutils/objdump.c:2445 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2445) in dump_bfd at binutils/objdump.c:3547 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3547) in display_file at binutils/objdump.c:3714 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714) in main at binutils/objdump.c:4016 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)
Created attachment 10122 [details] testcase
Created attachment 10123 [details] report
Additional Information: The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.
The master branch has been updated by Nick Clifton <nickc@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=63323b5b23bd83fa7b04ea00dff593c933e9b0e3 commit 63323b5b23bd83fa7b04ea00dff593c933e9b0e3 Author: Nick Clifton <nickc@redhat.com> Date: Thu Jun 15 12:37:01 2017 +0100 Fix address violation when disassembling a corrupt RL78 binary. PR binutils/21588 * rl78-decode.opc (OP_BUF_LEN): Define. (GETBYTE): Check for the index exceeding OP_BUF_LEN. (rl78_decode_opcode): Use OP_BUF_LEN as the length of the op_buf array. * rl78-decode.c: Regenerate.
Hi Aadamski, Thanks for reporting this bug. The problem this time was an overrun of the buffer used to contain RL78 opcodes. I have added a simple overflow check, so the problem should now be resolved. Cheers Nick