Bug 28048 - heap-buffer-overflow on `readelf -Ww`
Summary: heap-buffer-overflow on `readelf -Ww`
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.37
: P2 normal
Target Milestone: 2.37
Assignee: Alan Modra
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-07-02 09:00 UTC by Shaohua Li
Modified: 2021-07-02 13:52 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed: 2021-07-02 00:00:00


Attachments
poc (710 bytes, application/x-object)
2021-07-02 09:00 UTC, Shaohua Li
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Shaohua Li 2021-07-02 09:00:17 UTC
Created attachment 13526 [details]
poc

Hi there,

I crashed `readelf -Ww` with a fuzzer. There is a heap-buffer-overflow in printf_common. (See details below)

- Compiler: clang12
- Platform: Ubuntu 18.04.5 LTS, x86_64
- Reproduce: run `readelf -Ww poc`

The AddressSanitizer report:

==111713==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60e0000000de at pc 0x000000439d78 bp 0x7ffe03ee78e0 sp 0x7ffe03ee7060
READ of size 1 at 0x60e0000000de thread T0
    #0 0x439d77 in printf_common(void*, char const*, __va_list_tag*) (/out_bin/readelf+0x439d77)
    #1 0x43b0be in printf (/out_bin/readelf+0x43b0be)
    #2 0x588e66 in get_type_signedness /readelf/repo/binutils/dwarf.c
    #3 0x585053 in read_and_display_attr_value /readelf/repo/binutils/dwarf.c:2970:8
    #4 0x554cce in read_and_display_attr /readelf/repo/binutils/dwarf.c:3344:10
    #5 0x554cce in process_debug_info /readelf/repo/binutils/dwarf.c:3956:15
    #6 0x56731b in display_debug_info /readelf/repo/binutils/dwarf.c:7155:10
    #7 0x4feabb in display_debug_section /readelf/repo/binutils/readelf.c:15690:18
    #8 0x4feabb in process_section_contents /readelf/repo/binutils/readelf.c:15785:10
    #9 0x4dae6f in process_object /readelf/repo/binutils/readelf.c:21514:9
    #10 0x4cb6ed in process_file /readelf/repo/binutils/readelf.c:21939:13
    #11 0x4cb6ed in main /readelf/repo/binutils/readelf.c:22010:11
    #12 0x7f7fca356bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #13 0x41bfa9 in _start (/out_bin/readelf+0x41bfa9)

0x60e0000000de is located 0 bytes to the right of 158-byte region [0x60e000000040,0x60e0000000de)
allocated by thread T0 here:
    #0 0x496e6d in malloc (/out_bin/readelf+0x496e6d)
    #1 0x6ac52a in xmalloc /readelf/repo/libiberty/./xmalloc.c:147:12
    #2 0x4c9a1a in load_specific_debug_section /readelf/repo/binutils/readelf.c:15382:8
    #3 0x4fea79 in display_debug_section /readelf/repo/binutils/readelf.c:15684:8
    #4 0x4fea79 in process_section_contents /readelf/repo/binutils/readelf.c:15785:10
    #5 0x4dae6f in process_object /readelf/repo/binutils/readelf.c:21514:9
    #6 0x4cb6ed in process_file /readelf/repo/binutils/readelf.c:21939:13
    #7 0x4cb6ed in main /readelf/repo/binutils/readelf.c:22010:11
    #8 0x7f7fca356bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/out_bin/readelf+0x439d77) in printf_common(void*, char const*, __va_list_tag*)
Shadow bytes around the buggy address:
  0x0c1c7fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
=>0x0c1c7fff8010: 00 00 00 00 00 00 00 00 00 00 00[06]fa fa fa fa
  0x0c1c7fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==111713==ABORTING
Comment 1 cvs-commit@gcc.gnu.org 2021-07-02 13:51:25 UTC
The master branch has been updated by Alan Modra <amodra@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=4ff0bb2df5e0ce6dc30b8dd2a0d4174649d0dcfe

commit 4ff0bb2df5e0ce6dc30b8dd2a0d4174649d0dcfe
Author: Alan Modra <amodra@gmail.com>
Date:   Fri Jul 2 23:18:04 2021 +0930

    PR28048, heap-buffer-overflow on readelf -Ww
    
            PR 28048
            * dwarf.c (get_type_signedness): Don't run off end of buffer
            printing DW_FORM_string attribute.
Comment 2 Alan Modra 2021-07-02 13:51:55 UTC
Fixed