Created attachment 11153 [details] File which causes segfault Hi, I am working on a project in which I use the honggfuzz fuzzer to find bugs in open-source software and I decided to fuzz gas. In doing so, I discovered a segmentation fault in config/tc-i386.c, line 3989. Following is a detailed backtrace, as supplied by the address sanitizer: ASAN:DEADLYSIGNAL ================================================================= ==47033==ERROR: AddressSanitizer: SEGV on unknown address 0x55d1308f2630 (pc 0x7f7e731472c5 bp 0x7ffc7b39ab50 sp 0x7ffc7b39ab00 T0) ==47033==The signal is caused by a WRITE memory access. #0 0x7f7e731472c4 (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x262c4) #1 0x7f7e731fa8a3 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xd98a3) #2 0x55d13006afe5 in md_assemble config/tc-i386.c:3989 #3 0x55d12ff9ebb6 in assemble_one /home/jfe/binutils-gdb-noasan/gas/read.c:711 #4 0x55d12ff9ebb6 in read_a_source_file /home/jfe/binutils-gdb-noasan/gas/read.c:1179 #5 0x55d12fec0bb9 in perform_an_assembly_pass /home/jfe/binutils-gdb-noasan/gas/as.c:1187 #6 0x55d12fec0bb9 in main /home/jfe/binutils-gdb-noasan/gas/as.c:1331 #7 0x7f7e72b84a86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21a86) #8 0x55d12fec4db9 in _start (/home/jfe/binutils-gdb-noasan/gas/as-new+0x117db9) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x262c4) ==47033==ABORTING To reproduce this bug, run "gas /dev/stdin -o /dev/null<min", where min is the file attached. cheers project-repo
The master branch has been updated by H.J. Lu <hjl@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1286ab788188bb8f0b0da2a3def4641fb3817f10 commit 1286ab788188bb8f0b0da2a3def4641fb3817f10 Author: H.J. Lu <hjl.tools@gmail.com> Date: Fri Jul 27 06:35:09 2018 -0700 x86: Check for more than 2 memory references For movsd (%esi), %ss:(%edi), %ss:(%eax) we got [hjl@gnu-tools-1 tmp]$ as -o x.o x.s x.s: Assembler messages: x.s:1: Error: too many memory references for `movsd' munmap_chunk(): invalid pointer x.s:1: Internal error (Aborted). Please report this bug. [hjl@gnu-tools-1 tmp]$ struct _i386_insn has const seg_entry *seg[2]; 3 memory references will overflow the seg array. We should issue an error if there are more than 2 memory references. PR gas/23453 * config/tc-i386.c (parse_operands): Check for more than 2 memory references. * testsuite/gas/i386/inval.s: Add a movsd test with 3 memory references. * testsuite/gas/i386/x86-64-inval.s: Likewise. * testsuite/gas/i386/inval.l: Updated. * testsuite/gas/i386/x86-64-inval.l: Likewise.
Fixed for 2.32.