Created attachment 13526 [details] poc Hi there, I crashed `readelf -Ww` with a fuzzer. There is a heap-buffer-overflow in printf_common. (See details below) - Compiler: clang12 - Platform: Ubuntu 18.04.5 LTS, x86_64 - Reproduce: run `readelf -Ww poc` The AddressSanitizer report: ==111713==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60e0000000de at pc 0x000000439d78 bp 0x7ffe03ee78e0 sp 0x7ffe03ee7060 READ of size 1 at 0x60e0000000de thread T0 #0 0x439d77 in printf_common(void*, char const*, __va_list_tag*) (/out_bin/readelf+0x439d77) #1 0x43b0be in printf (/out_bin/readelf+0x43b0be) #2 0x588e66 in get_type_signedness /readelf/repo/binutils/dwarf.c #3 0x585053 in read_and_display_attr_value /readelf/repo/binutils/dwarf.c:2970:8 #4 0x554cce in read_and_display_attr /readelf/repo/binutils/dwarf.c:3344:10 #5 0x554cce in process_debug_info /readelf/repo/binutils/dwarf.c:3956:15 #6 0x56731b in display_debug_info /readelf/repo/binutils/dwarf.c:7155:10 #7 0x4feabb in display_debug_section /readelf/repo/binutils/readelf.c:15690:18 #8 0x4feabb in process_section_contents /readelf/repo/binutils/readelf.c:15785:10 #9 0x4dae6f in process_object /readelf/repo/binutils/readelf.c:21514:9 #10 0x4cb6ed in process_file /readelf/repo/binutils/readelf.c:21939:13 #11 0x4cb6ed in main /readelf/repo/binutils/readelf.c:22010:11 #12 0x7f7fca356bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6) #13 0x41bfa9 in _start (/out_bin/readelf+0x41bfa9) 0x60e0000000de is located 0 bytes to the right of 158-byte region [0x60e000000040,0x60e0000000de) allocated by thread T0 here: #0 0x496e6d in malloc (/out_bin/readelf+0x496e6d) #1 0x6ac52a in xmalloc /readelf/repo/libiberty/./xmalloc.c:147:12 #2 0x4c9a1a in load_specific_debug_section /readelf/repo/binutils/readelf.c:15382:8 #3 0x4fea79 in display_debug_section /readelf/repo/binutils/readelf.c:15684:8 #4 0x4fea79 in process_section_contents /readelf/repo/binutils/readelf.c:15785:10 #5 0x4dae6f in process_object /readelf/repo/binutils/readelf.c:21514:9 #6 0x4cb6ed in process_file /readelf/repo/binutils/readelf.c:21939:13 #7 0x4cb6ed in main /readelf/repo/binutils/readelf.c:22010:11 #8 0x7f7fca356bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6) SUMMARY: AddressSanitizer: heap-buffer-overflow (/out_bin/readelf+0x439d77) in printf_common(void*, char const*, __va_list_tag*) Shadow bytes around the buggy address: 0x0c1c7fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c1c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c1c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c1c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c1c7fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 =>0x0c1c7fff8010: 00 00 00 00 00 00 00 00 00 00 00[06]fa fa fa fa 0x0c1c7fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==111713==ABORTING
The master branch has been updated by Alan Modra <amodra@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=4ff0bb2df5e0ce6dc30b8dd2a0d4174649d0dcfe commit 4ff0bb2df5e0ce6dc30b8dd2a0d4174649d0dcfe Author: Alan Modra <amodra@gmail.com> Date: Fri Jul 2 23:18:04 2021 +0930 PR28048, heap-buffer-overflow on readelf -Ww PR 28048 * dwarf.c (get_type_signedness): Don't run off end of buffer printing DW_FORM_string attribute.
Fixed