Bug 21594 - global-buffer-overflow in OP_G
Summary: global-buffer-overflow in OP_G
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.29
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
Depends on:
Reported: 2017-06-14 12:36 UTC by Alexandre Adamski
Modified: 2017-06-16 12:31 UTC (History)
1 user (show)

See Also:
Last reconfirmed:

testcase (46 bytes, application/x-core)
2017-06-14 12:36 UTC, Alexandre Adamski
report (1.07 KB, text/plain)
2017-06-14 12:37 UTC, Alexandre Adamski

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandre Adamski 2017-06-14 12:36:34 UTC
Hello there,

I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the ASAN report log ("Output"). Below is the reduced stacktrace with links to the corresponding source lines on a GitHub mirror.

The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.

Let me know if there is any additional information I can provide.


Input: f7920e08be4fd15ae9622aaf8dc4931e.139b2c2a6fd324fdc13d6886dc01d3bf.min
Output: f7920e08be4fd15ae9622aaf8dc4931e.139b2c2a6fd324fdc13d6886dc01d3bf.txt

Error in "OP_G": global-buffer-overflow
  in OP_G at opcodes/i386-dis.c:15572
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/i386-dis.c#L15572)
  in print_insn at opcodes/i386-dis.c:13336
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/i386-dis.c#L13336)
  in disassemble_bytes at binutils/objdump.c:1864
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L1864)
  in disassemble_section at binutils/objdump.c:2309
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2309)
  in bfd_map_over_sections at bfd/section.c:1395
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/section.c#L1395)
  in disassemble_data at binutils/objdump.c:2445
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2445)
  in dump_bfd at binutils/objdump.c:3547
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3547)
  in display_file at binutils/objdump.c:3714
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
  in main at binutils/objdump.c:4016
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)
Comment 1 Alexandre Adamski 2017-06-14 12:36:54 UTC
Created attachment 10134 [details]
Comment 2 Alexandre Adamski 2017-06-14 12:37:08 UTC
Created attachment 10135 [details]
Comment 3 Sourceware Commits 2017-06-15 13:42:27 UTC
The master branch has been updated by H.J. Lu <hjl@sourceware.org>:


commit 0d96e4df4812c3bad77c229dfef47a9bc115ac12
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Thu Jun 15 06:40:17 2017 -0700

    i386-dis: Check valid bnd register
    Since there are only 4 bnd registers, return "(bad)" for register
    number > 3.
    	PR binutils/21594
    	* i386-dis.c (OP_E_register): Check valid bnd register.
    	(OP_G): Likewise.
Comment 4 Sourceware Commits 2017-06-15 15:22:57 UTC
The master branch has been updated by H.J. Lu <hjl@sourceware.org>:


commit 8cac017d35ef374e65acc98818a17cf8a652cbd0
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Thu Jun 15 08:21:48 2017 -0700

    i386-dis: Add 2 tests with invalid bnd register
    	PR binutils/21594
    	* testsuite/gas/i386/mpx.s: Add 2 tests with invalid bnd
    	* testsuite/gas/i386/x86-64-mpx.s: Likewise.
    	* testsuite/gas/i386/mpx.d: Updated.
    	* testsuite/gas/i386/x86-64-mpx.d: Likewise.
Comment 5 Nick Clifton 2017-06-16 12:31:49 UTC
Patch committed.