Created attachment 10991 [details] objcopy crash As part of a tool I'm writing I fuzzed binutils. The attached file makes objcopy crash inside `bfd_elf_set_group_contents`: Program received signal SIGSEGV, Segmentation fault. 0x000000000043bc33 in bfd_elf_set_group_contents (abfd=0x7322e0, sec=0x738f20, failedptrarg=0x7fffffffd83c) at elf.c:3462 3462 symindx = elf_section_syms (abfd)[sec->index]->udata.i; #0 0x000000000043bc33 in bfd_elf_set_group_contents (abfd=0x7322e0, sec=0x738f20, failedptrarg=0x7fffffffd83c) at elf.c:3462 #1 0x000000000042639c in bfd_map_over_sections (abfd=abfd@entry=0x7322e0, operation=operation@entry=0x43b9e0 <bfd_elf_set_group_contents>, user_storage=user_storage@entry=0x7fffffffd83c) at section.c:1391 #2 0x0000000000443807 in _bfd_elf_compute_section_file_positions (abfd=<optimized out>, link_info=link_info@entry=0x0) at elf.c:4250 #3 0x0000000000448f6c in _bfd_elf_set_section_contents (abfd=0x7322e0, section=0x738df0, location=0x734620, offset=0, count=19) at elf.c:8854 #4 0x00000000004264f4 in bfd_set_section_contents (abfd=abfd@entry=0x7322e0, section=section@entry=0x738df0, location=0x734620, offset=offset@entry=0, count=<optimized out>) at section.c:1529 #5 0x00000000004070f3 in copy_section (ibfd=<optimized out>, isection=<optimized out>, obfdarg=0x7322e0) at objcopy.c:4108 #6 0x000000000042639c in bfd_map_over_sections (abfd=abfd@entry=0x72ef40, operation=operation@entry=0x406e20 <copy_section>, user_storage=user_storage@entry=0x7322e0) at section.c:1391 #7 0x0000000000408864 in copy_object (ibfd=<optimized out>, obfd=<optimized out>, input_arch=<optimized out>) at objcopy.c:3057 #8 0x000000000040a63a in copy_file (input_filename=input_filename@entry=0x7fffffffe131 "id:000008,sig:1"..., output_filename=output_filename@entry=0x7fffffffe164 "/dev/null", input_target=input_target@entry=0x0, output_target=<optimized out>, output_target@entry=0x0, input_arch=input_arch@entry=0x0) at objcopy.c:3532 #9 0x0000000000403334 in copy_main (argv=<optimized out>, argc=<optimized out>) at objcopy.c:5484 #10 main (argc=argc@entry=3, argv=argv@entry=0x7fffffffdd88) at objcopy.c:5588 #11 0x00007ffff7829830 in __libc_start_main (main=0x402ea0 <main>, argc=3, argv=0x7fffffffdd88, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdd78) at ../csu/libc-start.c:291 #12 0x00000000004055c9 in _start () Compiled and tried against a freshly cloned repo. It also works on Ubuntu Xenial's binutils (2.26.1).
The master branch has been updated by Alan Modra <amodra@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=886d542809fd73fba55ba72da1bd64ba50164222 commit 886d542809fd73fba55ba72da1bd64ba50164222 Author: Alan Modra <amodra@gmail.com> Date: Tue May 8 14:32:04 2018 +0930 PR23141, SIGSEGV in bfd_elf_set_group_contents Another fuzzing fix. I think it's reasonable to simply strip out any group section that is too weird for objcopy to handle. PR 23141 * objcopy.c (is_strip_section): Strip groups without a valid signature symbol.
Fixed