Created attachment 10992 [details] crash As part of a tool I'm writing I fuzzed binutils. The attached file makes objcopy crash inside `is_strip_section`: Program received signal SIGSEGV, Segmentation fault. is_strip_section (sec=sec@entry=0x730950, abfd=0x72ef40) at objcopy.c:1352 1352 gname = gsym->name; #0 is_strip_section (sec=sec@entry=0x730950, abfd=0x72ef40) at objcopy.c:1352 #1 0x0000000000406db5 in skip_section (ibfd=0x72ef40, isection=0x730950, skip_copy=1) at objcopy.c:3849 #2 0x0000000000406e4f in copy_section (ibfd=0x72ef40, isection=0x730950, obfdarg=0x7322e0) at objcopy.c:4026 #3 0x000000000042639c in bfd_map_over_sections (abfd=abfd@entry=0x72ef40, operation=operation@entry=0x406e20 <copy_section>, user_storage=user_storage@entry=0x7322e0) at section.c:1391 #4 0x0000000000408864 in copy_object (ibfd=<optimized out>, obfd=<optimized out>, input_arch=<optimized out>) at objcopy.c:3057 #5 0x000000000040a63a in copy_file (input_filename=input_filename@entry=0x7fffffffe131 "id:000010,sig:1"..., output_filename=output_filename@entry=0x7fffffffe164 "/dev/null", input_target=input_target@entry=0x0, output_target=<optimized out>, output_target@entry=0x0, input_arch=input_arch@entry=0x0) at objcopy.c:3532 #6 0x0000000000403334 in copy_main (argv=<optimized out>, argc=<optimized out>) at objcopy.c:5484 #7 main (argc=argc@entry=3, argv=argv@entry=0x7fffffffdd88) at objcopy.c:5588 #8 0x00007ffff7829830 in __libc_start_main (main=0x402ea0 <main>, argc=3, argv=0x7fffffffdd88, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdd78) at ../csu/libc-start.c:291 #9 0x00000000004055c9 in _start () Compiled and tried against a freshly cloned repo. It also works on Ubuntu Xenial's binutils (2.26.1).
Created attachment 10993 [details] crash 2
Created attachment 10994 [details] crash 3
Crash 1 and 2 are actually the same file, sorry.
The master branch has been updated by Alan Modra <amodra@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ce4ec1a9b6c442a9feefa18dd8734372a718665c commit ce4ec1a9b6c442a9feefa18dd8734372a718665c Author: Alan Modra <amodra@gmail.com> Date: Mon May 7 22:41:47 2018 +0930 Bug 23142, SIGSEGV in is_strip_section PR 23142 * objcopy.c (group_signature): Don't accept groups that use a symbol table other than the one we've read.
Fixed
Can you help me get a CVE for that? On Mon, May 7, 2018 at 6:28 AM, amodra at gmail dot com <sourceware-bugzilla@sourceware.org> wrote: > https://sourceware.org/bugzilla/show_bug.cgi?id=23142 > > Alan Modra <amodra at gmail dot com> changed: > > What |Removed |Added > ---------------------------------------------------------------------------- > Status|ASSIGNED |RESOLVED > CC|amodra at gmail dot com | > Resolution|--- |FIXED > > --- Comment #5 from Alan Modra <amodra at gmail dot com> --- > Fixed > > -- > You are receiving this mail because: > You reported the bug.
*** Bug 23143 has been marked as a duplicate of this bug. ***
*** Bug 23144 has been marked as a duplicate of this bug. ***