Bug 29873 - Out of bound read at `case DST__K_DELTA_PC_W` handler in function `parse_module`
Summary: Out of bound read at `case DST__K_DELTA_PC_W` handler in function `parse_module`
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.40
: P2 normal
Target Milestone: 2.40
Assignee: Alan Modra
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-12-12 03:28 UTC by 2019
Modified: 2022-12-12 09:01 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed: 2022-12-12 00:00:00


Attachments
PoC (8.30 KB, model/x.stl-binary)
2022-12-12 03:28 UTC, 2019
Details

Note You need to log in before you can comment on or make changes to this bug.
Description 2019 2022-12-12 03:28:13 UTC
Created attachment 14494 [details]
PoC

# Reproduce

```bash
cd binutils-gdb
git reset --hard f2f58a399cf3f946983398cdfe52d0eaa72bf877
mkdir build && cd build
../configure --disable-gdb --disable-gdbserver --disable-gdbsupport --disable-libdecnumber --disable-readline --disable-sim --disable-libbacktrace --disable-gas --disable-ld --disable-werror --enable-targets=all CPPFLAGS=-DDEBUG CFLAGS="-g -O0 -fsanitize=address"
make all-binutils MAKEINFO=true && true
binutils/addr2line -e poc.bin 0
```

# Output

```
binutils/addr2line: DST__K_SET_PC not implemented
binutils/addr2line: DST__K_SET_LINUM_INCR not implemented
binutils/addr2line: unknown line command 127
binutils/addr2line: unknown line command 76
binutils/addr2line: unknown line command 104
binutils/addr2line: unknown line command 64
binutils/addr2line: unknown line command 64
binutils/addr2line: unknown line command 43
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 65
binutils/addr2line: unknown line command 65
binutils/addr2line: unknown line command 65
binutils/addr2line: unknown line command 65
binutils/addr2line: unknown line command 83
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 72
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
binutils/addr2line: unknown line command 56
binutils/addr2line: unknown line command 116
binutils/addr2line: DST__K_END_STMT_MODE not implemented
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 67
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 117
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 75
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 65
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 67
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 48
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 67
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 65
binutils/addr2line: unknown line command 65
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 65
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 75
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 127
binutils/addr2line: unknown line command 67
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 127
binutils/addr2line: DST__K_END_STMT_MODE not implemented
binutils/addr2line: unknown line command 127
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 24
binutils/addr2line: unknown line command 127
binutils/addr2line: unknown line command 32
binutils/addr2line: unknown line command 127
binutils/addr2line: unknown line command 102
binutils/addr2line: unknown line command 36
binutils/addr2line: unknown line command 127
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 38
binutils/addr2line: unknown line command 127
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 127
binutils/addr2line: unknown line command 127
binutils/addr2line: unknown line command 65
binutils/addr2line: unknown line command 127
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
binutils/addr2line: unknown line command 100
binutils/addr2line: unknown line command 59
binutils/addr2line: unknown line command 115
binutils/addr2line: unknown line command 100
binutils/addr2line: unknown line command 40
binutils/addr2line: unknown line command 87
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 67
binutils/addr2line: DST__K_SET_LINUM_INCR not implemented
binutils/addr2line: unknown line command 64
binutils/addr2line: unknown line command 64
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 120
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 123
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 67
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 67
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 67
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 67
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 67
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 67
binutils/addr2line: unknown line command 69
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 127
binutils/addr2line: DST__K_SET_PC_L not implemented
binutils/addr2line: unknown line command 54
binutils/addr2line: unknown line command 83
binutils/addr2line: unknown line command 74
binutils/addr2line: DST__K_SET_LINUM_INCR not implemented
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 51
binutils/addr2line: unknown line command 57
binutils/addr2line: unknown line command 118
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
binutils/addr2line: unknown line command 102
binutils/addr2line: unknown line command 76
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 26
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
binutils/addr2line: DST__K_SET_LINUM_INCR not implemented
binutils/addr2line: unknown line command 56
binutils/addr2line: unknown line command 76
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 126
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
binutils/addr2line: DST__K_SET_PC not implemented
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
binutils/addr2line: unknown line command 67
binutils/addr2line: unknown line command 76
binutils/addr2line: unknown line command 43
binutils/addr2line: unknown line command 41
binutils/addr2line: unknown line command 75
binutils/addr2line: unknown line command 60
binutils/addr2line: unknown line command 72
binutils/addr2line: DST__K_BEG_STMT_MODE not implemented
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 116
binutils/addr2line: unknown line command 77
binutils/addr2line: unknown line command 76
binutils/addr2line: unknown line command 107
binutils/addr2line: unknown line command 77
binutils/addr2line: unknown line command 101
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 115
binutils/addr2line: unknown line command 76
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 67
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 71
binutils/addr2line: unknown line command 76
binutils/addr2line: unknown line command 123
binutils/addr2line: unknown line command 77
binutils/addr2line: unknown line command 111
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 76
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 76
binutils/addr2line: unknown line command 107
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 115
binutils/addr2line: unknown line command 76
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 123
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 123
binutils/addr2line: unknown line command 116
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
binutils/addr2line: unknown line command 26
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
binutils/addr2line: DST__K_SET_LINUM_INCR not implemented
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 75
binutils/addr2line: unknown line command 29
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
binutils/addr2line: unknown line command 76
binutils/addr2line: unknown line command 107
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 67
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 76
binutils/addr2line: unknown line command 99
binutils/addr2line: unknown line command 76
binutils/addr2line: unknown line command 107
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 75
binutils/addr2line: unknown line command 116
binutils/addr2line: unknown line command 74
binutils/addr2line: unknown line command 48
binutils/addr2line: DST__K_SET_LINUM_INCR not implemented
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 67
binutils/addr2line: unknown line command 74
binutils/addr2line: DST__K_SET_LINUM_INCR not implemented
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 57
binutils/addr2line: unknown line command 118
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
binutils/addr2line: unknown line command 28
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
binutils/addr2line: unknown line command 102
binutils/addr2line: unknown line command 31
binutils/addr2line: unknown line command 68
binutils/addr2line: unknown line command 69
binutils/addr2line: DST__K_SET_PC_L not implemented
binutils/addr2line: unknown line command 68
binutils/addr2line: unknown line command 65
binutils/addr2line: unknown line command 113
binutils/addr2line: unknown line command 76
binutils/addr2line: unknown line command 99
binutils/addr2line: unknown line command 77
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 36
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 127
binutils/addr2line: DST__K_SET_PC not implemented
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 30
binutils/addr2line: unknown line command 68
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 76
binutils/addr2line: unknown line command 72
binutils/addr2line: unknown line command 73
binutils/addr2line: unknown line command 68
binutils/addr2line: unknown line command 45
binutils/addr2line: unknown line command 68
binutils/addr2line: unknown line command 65
binutils/addr2line: unknown line command 117
binutils/addr2line: DST__K_SET_LINUM_INCR_W not implemented
=================================================================
==178131==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61a000000b80 at pc 0x55f4aeb80c4e bp 0x7ffed2e33210 sp 0x7ffed2e33200
READ of size 1 at 0x61a000000b80 thread T0
    #0 0x55f4aeb80c4d in bfd_getl16 ../../bfd/libbfd.c:633
    #1 0x55f4af140fa8 in parse_module ../../bfd/vms-alpha.c:4585
    #2 0x55f4af141fad in module_find_nearest_line ../../bfd/vms-alpha.c:4902
    #3 0x55f4af142911 in _bfd_vms_find_nearest_line ../../bfd/vms-alpha.c:4982
    #4 0x55f4aeb6eb1e in find_address_in_section ../../binutils/addr2line.c:197
    #5 0x55f4aeb89f43 in bfd_map_over_sections ../../bfd/section.c:1366
    #6 0x55f4aeb6f8eb in translate_addresses ../../binutils/addr2line.c:337
    #7 0x55f4aeb6ffbc in process_file ../../binutils/addr2line.c:470
    #8 0x55f4aeb705b1 in main ../../binutils/addr2line.c:579
    #9 0x7fd755b10d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #10 0x7fd755b10e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #11 0x55f4aeb6e244 in _start (/binutils-gdb/build/binutils/addr2line+0x343244)

0x61a000000b80 is located 0 bytes to the right of 1280-byte region [0x61a000000680,0x61a000000b80)
allocated by thread T0 here:
    #0 0x7fd755dc3867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x55f4aeb808d5 in bfd_malloc ../../bfd/libbfd.c:289
    #2 0x55f4af12b13a in _bfd_malloc_and_read ../../bfd/libbfd.h:970
    #3 0x55f4af141f77 in module_find_nearest_line ../../bfd/vms-alpha.c:4896
    #4 0x55f4af142911 in _bfd_vms_find_nearest_line ../../bfd/vms-alpha.c:4982
    #5 0x55f4aeb6eb1e in find_address_in_section ../../binutils/addr2line.c:197
    #6 0x55f4aeb89f43 in bfd_map_over_sections ../../bfd/section.c:1366
    #7 0x55f4aeb6f8eb in translate_addresses ../../binutils/addr2line.c:337
    #8 0x55f4aeb6ffbc in process_file ../../binutils/addr2line.c:470
    #9 0x55f4aeb705b1 in main ../../binutils/addr2line.c:579
    #10 0x7fd755b10d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../bfd/libbfd.c:633 in bfd_getl16
Shadow bytes around the buggy address:
  0x0c347fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c347fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c347fff8140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c347fff8150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c347fff8160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c347fff8170:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c347fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c347fff8190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c347fff81a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c347fff81b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c347fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==178131==ABORTING
Aborted (core dumped)
```

# Analysis

`pcl_ptr + DST_S_W_PCLINE_UNSWORD` is accessed without bound check.
Comment 1 Sourceware Commits 2022-12-12 08:59:40 UTC
The master branch has been updated by Alan Modra <amodra@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=77c225bdeb410cf60da804879ad41622f5f1aa44

commit 77c225bdeb410cf60da804879ad41622f5f1aa44
Author: Alan Modra <amodra@gmail.com>
Date:   Mon Dec 12 18:28:49 2022 +1030

    Lack of bounds checking in vms-alpha.c parse_module
    
            PR 29873
            PR 29874
            PR 29875
            PR 29876
            PR 29877
            PR 29878
            PR 29879
            PR 29880
            PR 29881
            PR 29882
            PR 29883
            PR 29884
            PR 29885
            PR 29886
            PR 29887
            PR 29888
            PR 29889
            PR 29890
            PR 29891
            * vms-alpha.c (parse_module): Make length param bfd_size_type.
            Delete length == -1 checks.  Sanity check record_length.
            Sanity check DST__K_MODBEG, DST__K_RTNBEG, DST__K_RTNEND lengths.
            Sanity check DST__K_SOURCE and DST__K_LINE_NUM elements
            before accessing.
            (build_module_list): Pass dst_section size to parse_module.
Comment 2 Alan Modra 2022-12-12 09:01:03 UTC
.