Bug 23142 - objcopy: SIGSEGV in is_strip_section
Summary: objcopy: SIGSEGV in is_strip_section
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.31
: P2 normal
Target Milestone: ---
Assignee: Alan Modra
URL:
Keywords:
: 23143 23144 (view as bug list)
Depends on:
Blocks:
 
Reported: 2018-05-04 23:36 UTC by Paolo Montesel
Modified: 2018-05-08 04:03 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed: 2018-05-07 00:00:00


Attachments
crash (772 bytes, application/octet-stream)
2018-05-04 23:36 UTC, Paolo Montesel
Details
crash 2 (772 bytes, application/octet-stream)
2018-05-04 23:40 UTC, Paolo Montesel
Details
crash 3 (1.31 KB, application/x-executable)
2018-05-04 23:42 UTC, Paolo Montesel
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Paolo Montesel 2018-05-04 23:36:07 UTC
Created attachment 10992 [details]
crash

As part of a tool I'm writing I fuzzed binutils. The attached file makes objcopy crash inside `is_strip_section`:

Program received signal SIGSEGV, Segmentation fault.
is_strip_section (sec=sec@entry=0x730950, abfd=0x72ef40) at objcopy.c:1352
1352            gname = gsym->name;
#0  is_strip_section (sec=sec@entry=0x730950, abfd=0x72ef40) at objcopy.c:1352
#1  0x0000000000406db5 in skip_section (ibfd=0x72ef40, isection=0x730950, skip_copy=1) at objcopy.c:3849
#2  0x0000000000406e4f in copy_section (ibfd=0x72ef40, isection=0x730950, obfdarg=0x7322e0) at objcopy.c:4026
#3  0x000000000042639c in bfd_map_over_sections (abfd=abfd@entry=0x72ef40, operation=operation@entry=0x406e20 <copy_section>, user_storage=user_storage@entry=0x7322e0) at section.c:1391
#4  0x0000000000408864 in copy_object (ibfd=<optimized out>, obfd=<optimized out>, input_arch=<optimized out>) at objcopy.c:3057
#5  0x000000000040a63a in copy_file (input_filename=input_filename@entry=0x7fffffffe131 "id:000010,sig:1"..., output_filename=output_filename@entry=0x7fffffffe164 "/dev/null", input_target=input_target@entry=0x0, output_target=<optimized out>, output_target@entry=0x0, input_arch=input_arch@entry=0x0) at objcopy.c:3532
#6  0x0000000000403334 in copy_main (argv=<optimized out>, argc=<optimized out>) at objcopy.c:5484
#7  main (argc=argc@entry=3, argv=argv@entry=0x7fffffffdd88) at objcopy.c:5588
#8  0x00007ffff7829830 in __libc_start_main (main=0x402ea0 <main>, argc=3, argv=0x7fffffffdd88, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdd78) at ../csu/libc-start.c:291
#9  0x00000000004055c9 in _start ()

Compiled and tried against a freshly cloned repo. It also works on Ubuntu Xenial's binutils (2.26.1).
Comment 1 Paolo Montesel 2018-05-04 23:40:55 UTC
Created attachment 10993 [details]
crash 2
Comment 2 Paolo Montesel 2018-05-04 23:42:54 UTC
Created attachment 10994 [details]
crash 3
Comment 3 Paolo Montesel 2018-05-04 23:43:26 UTC
Crash 1 and 2 are actually the same file, sorry.
Comment 4 cvs-commit@gcc.gnu.org 2018-05-07 13:28:28 UTC
The master branch has been updated by Alan Modra <amodra@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ce4ec1a9b6c442a9feefa18dd8734372a718665c

commit ce4ec1a9b6c442a9feefa18dd8734372a718665c
Author: Alan Modra <amodra@gmail.com>
Date:   Mon May 7 22:41:47 2018 +0930

    Bug 23142, SIGSEGV in is_strip_section
    
    	PR 23142
    	* objcopy.c (group_signature): Don't accept groups that use a
    	symbol table other than the one we've read.
Comment 5 Alan Modra 2018-05-07 13:28:57 UTC
Fixed
Comment 6 paolo.montesel 2018-05-07 20:08:18 UTC
Can you help me get a CVE for that?

On Mon, May 7, 2018 at 6:28 AM, amodra at gmail dot com
<sourceware-bugzilla@sourceware.org> wrote:
> https://sourceware.org/bugzilla/show_bug.cgi?id=23142
>
> Alan Modra <amodra at gmail dot com> changed:
>
>            What    |Removed                     |Added
> ----------------------------------------------------------------------------
>              Status|ASSIGNED                    |RESOLVED
>                  CC|amodra at gmail dot com            |
>          Resolution|---                         |FIXED
>
> --- Comment #5 from Alan Modra <amodra at gmail dot com> ---
> Fixed
>
> --
> You are receiving this mail because:
> You reported the bug.
Comment 7 Alan Modra 2018-05-08 03:57:45 UTC
*** Bug 23143 has been marked as a duplicate of this bug. ***
Comment 8 Alan Modra 2018-05-08 04:03:59 UTC
*** Bug 23144 has been marked as a duplicate of this bug. ***