Bug 23143 - objcopy: SIGSEGV in htab_hash_string
Summary: objcopy: SIGSEGV in htab_hash_string
Status: RESOLVED DUPLICATE of bug 23142
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.31
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-05-04 23:45 UTC by Paolo Montesel
Modified: 2018-05-08 03:57 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments
crash (788 bytes, application/octet-stream)
2018-05-04 23:45 UTC, Paolo Montesel
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Paolo Montesel 2018-05-04 23:45:43 UTC
Created attachment 10995 [details]
crash

As part of a tool I'm writing I fuzzed binutils. The attached file makes objcopy crash inside `htab_hash_string`:

Program received signal SIGSEGV, Segmentation fault.
htab_hash_string (p=0xde89483b74ff8548) at ./hashtab.c:838
838       while ((c = *str++) != 0)
#0  htab_hash_string (p=0xde89483b74ff8548) at ./hashtab.c:838
#1  0x00000000004c7151 in htab_find (htab=0x72e1c0, element=0xde89483b74ff8548) at ./hashtab.c:621
#2  0x000000000040685c in is_specified_symbol (name=<optimized out>, htab=<optimized out>) at objcopy.c:1195
#3  0x0000000000406904 in is_strip_section (sec=sec@entry=0x730950, abfd=0x72ef40) at objcopy.c:1357
#4  0x0000000000406db5 in skip_section (ibfd=0x72ef40, isection=0x730950, skip_copy=1) at objcopy.c:3849
#5  0x0000000000406e4f in copy_section (ibfd=0x72ef40, isection=0x730950, obfdarg=0x7322e0) at objcopy.c:4026
#6  0x000000000042639c in bfd_map_over_sections (abfd=abfd@entry=0x72ef40, operation=operation@entry=0x406e20 <copy_section>, user_storage=user_storage@entry=0x7322e0) at section.c:1391
#7  0x0000000000408864 in copy_object (ibfd=<optimized out>, obfd=<optimized out>, input_arch=<optimized out>) at objcopy.c:3057
#8  0x000000000040a63a in copy_file (input_filename=input_filename@entry=0x7fffffffe139 "id:000011,sig:1"..., output_filename=output_filename@entry=0x7fffffffe164 "/dev/null", input_target=input_target@entry=0x0, output_target=<optimized out>, output_target@entry=0x0, input_arch=input_arch@entry=0x0) at objcopy.c:3532
#9  0x0000000000403334 in copy_main (argv=<optimized out>, argc=<optimized out>) at objcopy.c:5484
#10 main (argc=argc@entry=3, argv=argv@entry=0x7fffffffdd98) at objcopy.c:5588
#11 0x00007ffff7829830 in __libc_start_main (main=0x402ea0 <main>, argc=3, argv=0x7fffffffdd98, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdd88) at ../csu/libc-start.c:291
#12 0x00000000004055c9 in _start ()

Compiled and tried against a freshly cloned repo. It also works on Ubuntu Xenial's binutils (2.26.1). X86_64 machine.
Comment 1 Alan Modra 2018-05-08 03:56:11 UTC
Doesn't crash for me after applying pr21342 fix

*** This bug has been marked as a duplicate of bug 21342 ***
Comment 2 Alan Modra 2018-05-08 03:57:45 UTC

*** This bug has been marked as a duplicate of bug 23142 ***