Bug 26189 - heap user after free in nm bfd_hash_lookup
Summary: heap user after free in nm bfd_hash_lookup
Status: RESOLVED DUPLICATE of bug 25823
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.34
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-06-30 16:15 UTC by Harvey
Modified: 2020-07-01 07:08 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments
POC input (1.51 KB, application/x-ms-dos-executable)
2020-06-30 16:15 UTC, Harvey
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Harvey 2020-06-30 16:15:01 UTC
Created attachment 12674 [details]
POC input

Hi, there.

There is a use after free in bfd_hash_lookup, triggered by nm-new -al
To reproduce,
run
nm-new -al input


Here is the trace reported by ASAN:
==141996==ERROR: AddressSanitizer: heap-use-after-free on address 0x61800000f8a0 at pc 0x7f01e43562c5 bp 0x7fff7acf0710 sp 0x7fff7acefeb8
READ of size 4 at 0x61800000f8a0 thread T0
    #0 0x7f01e43562c4  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x472c4)
    #1 0x456083 in bfd_hash_lookup ../../bfd/hash.c:475
    #2 0x471dd8 in bfd_get_section_by_name ../../bfd/section.c:884
    #3 0x71e0de in _bfd_pei_swap_sym_in /mnt/data/playground/binutils-2.34-a/build/bfd/peigen.c:170
    #4 0x77cad1 in coff_get_normalized_symtab ../../bfd/coffgen.c:1849
    #5 0x7041b2 in coff_slurp_symbol_table ../../bfd/coffcode.h:4465
    #6 0x766da6 in coff_get_symtab_upper_bound ../../bfd/coffgen.c:426
    #7 0x478b80 in _bfd_generic_read_minisymbols ../../bfd/syms.c:813
    #8 0x40eec9 in display_rel_file ../../binutils/nm.c:1112
    #9 0x4129ec in display_file ../../binutils/nm.c:1379
    #10 0x4081a7 in main ../../binutils/nm.c:1860
    #11 0x7f01e3d6182f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #12 0x40a248 in _start (/mnt/data/playground/binutils-2.34-a/build/binutils/nm-new+0x40a248)

0x61800000f8a0 is located 32 bytes inside of 893-byte region [0x61800000f880,0x61800000fbfd)
freed by thread T0 here:
    #0 0x7f01e43a732a in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9832a)
    #1 0x77a11c in _bfd_coff_free_symbols ../../bfd/coffgen.c:1789
    #2 0x77a11c in coff_real_object_p ../../bfd/coffgen.c:307

previously allocated by thread T0 here:
    #0 0x7f01e43a7662 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98662)
    #1 0x45a15a in bfd_malloc ../../bfd/libbfd.c:275

SUMMARY: AddressSanitizer: heap-use-after-free ??:0 ??
Shadow bytes around the buggy address:
  0x0c307fff9ec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff9ed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff9ee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff9ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05
  0x0c307fff9f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c307fff9f10: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
  0x0c307fff9f20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c307fff9f30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c307fff9f40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c307fff9f50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c307fff9f60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==141996==ABORTING
Comment 1 Alan Modra 2020-07-01 07:08:21 UTC
Dup

*** This bug has been marked as a duplicate of bug 25823 ***