Bug 28175 - Segment fault in coff-tic30.c reloc_processing
Summary: Segment fault in coff-tic30.c reloc_processing
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.38
: P2 normal
Target Milestone: 2.38
Assignee: Alan Modra
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-08-02 21:09 UTC by Shaohua Li
Modified: 2021-08-06 13:39 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed: 2021-08-06 00:00:00

Attachments
poc (1.41 KB, model/x.stl-binary)
2021-08-02 21:09 UTC, Shaohua Li 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Shaohua Li 2021-08-02 21:09:08 UTC 
Created attachment 13585 [details]
poc

Hi there,

I crashed `nm-new -a -l` with a fuzzer.

- binutils version: 2.38(Head), commit af51804103a08cd1e12edc4f4a30eec2c5c4f9e8
- Compiler: clang12
- Platform: Ubuntu 18.04.5 LTS, x86_64
- Reproduce: run `nm-new -a -l poc`

AddressSanitizer report:

==640==ERROR: AddressSanitizer: SEGV on unknown address 0x621050000558 (pc 0x000000ced0ab bp 0x7ffff11c0d70 sp 0x7ffff11c0ca0 T0)
==640==The signal is caused by a READ memory access.
    #0 0xced0ab in reloc_processing /binutils_latest/repo/bfd/coff-tic30.c:165:35
    #1 0xceac05 in coff_slurp_reloc_table /binutils_latest/repo/bfd/./coffcode.h:5120:7
    #2 0xce63d8 in coff_canonicalize_reloc /binutils_latest/repo/bfd/./coffcode.h:5238:13
    #3 0x4e96db in bfd_canonicalize_reloc /binutils_latest/repo/bfd/bfd.c:1579:10
    #4 0x4d2276 in get_relocs /binutils_latest/repo/binutils/nm.c:913:25
    #5 0x50e6ba in bfd_map_over_sections /binutils_latest/repo/bfd/section.c:1383:5
    #6 0x4d147a in print_symbol /binutils_latest/repo/binutils/nm.c:1037:8
    #7 0x4ceaeb in print_symbols /binutils_latest/repo/binutils/nm.c:1152:7
    #8 0x4cd23c in display_rel_file /binutils_latest/repo/binutils/nm.c:1279:5
    #9 0x4c97dd in display_file /binutils_latest/repo/binutils/nm.c:1446:7
    #10 0x4c90db in main /binutils_latest/repo/binutils/nm.c:1965:12
    #11 0x7fda9a2cb0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #12 0x41c55d in _start (/out_bin/nm-new+0x41c55d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /binutils_latest/repo/bfd/coff-tic30.c:165:35 in reloc_processing
==640==ABORTING
Comment 1 Sourceware Commits 2021-08-06 13:37:37 UTC 
The master branch has been updated by Alan Modra <amodra@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=e039f7ed8675ddc9d2aa1e60df49dbc8d2836fc7

commit e039f7ed8675ddc9d2aa1e60df49dbc8d2836fc7
Author: Alan Modra <amodra@gmail.com>
Date:   Fri Aug 6 20:48:41 2021 +0930

    PR28175, Segment fault in coff-tic30.c reloc_processing
    
    The obj_convert table shouldn't be accessed without first checking the
    index against the table size.
    
            PR 28175
            * coff-tic30.c (reloc_processing): Sanity check reloc symbol index.
            * coff-z80.c (reloc_processing): Likewise.
            * coff-z8k.c (reloc_processing): Likewise.
Comment 2 Alan Modra 2021-08-06 13:39:40 UTC 
Fixed for 2.38