Bug 30326 - Objdump: Use of uninitialized value in objdump.c
Summary: Objdump: Use of uninitialized value in objdump.c
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: ---
Assignee: Alan Modra
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-04-07 14:07 UTC by Ziqiao Kong
Modified: 2023-04-12 05:14 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed: 2023-04-12 00:00:00


Attachments
Contains both obj file and valgrind logs (3.44 KB, application/x-xz)
2023-04-07 14:07 UTC, Ziqiao Kong
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Ziqiao Kong 2023-04-07 14:07:26 UTC
Created attachment 14808 [details]
Contains both obj file and valgrind logs

Git commit hash: 929a05081ec2ca6448927b96f673b0cd9633a342 (not sure which version it belongs to)

Steps to reproduce:

```
./configure
make -j
valgrind --leak-check=full --tool=memcheck ./binutils/objdump -D /path/to/obj 
```

Valgrind output:

```
==297370== Memcheck, a memory error detector
==297370== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==297370== Using Valgrind-3.18.1 and LibVEX; rerun with -h for copyright info
==297370== Command: /binutils/binutils/objdump -D /work/tmpfs/obj
==297370==
BFD: warning: /work/tmpfs/obj has a section extending past end of file
/work/tmpfs/obj: unable to decompress section .debug_inXo
/work/tmpfs/obj: no group info for section '.debug_inXo'

/work/tmpfs/obj:     file format elf32-i386

BFD: /work/tmpfs/obj: attempt to load strings from a non-string section (number 11)
BFD: /work/tmpfs/obj(.rela.debug_inXo): relocation 5 has invalid symbol index 257
==297370== Conditional jump or move depends on uninitialised value(s)
==297370==    at 0x167998: compare_relocs (in /binutils/binutils/objdump)
==297370==    by 0x48A540E: msort_with_tmp.part.0 (msort.c:82)
==297370==    by 0x48A53C1: msort_with_tmp (msort.c:44)
==297370==    by 0x48A53C1: msort_with_tmp.part.0 (msort.c:53)
==297370==    by 0x48A53A4: msort_with_tmp (msort.c:44)
==297370==    by 0x48A53A4: msort_with_tmp.part.0 (msort.c:52)
==297370==    by 0x48A53C1: msort_with_tmp (msort.c:44)
==297370==    by 0x48A53C1: msort_with_tmp.part.0 (msort.c:53)
==297370==    by 0x48A53A4: msort_with_tmp (msort.c:44)
==297370==    by 0x48A53A4: msort_with_tmp.part.0 (msort.c:52)
==297370==    by 0x48A5A55: msort_with_tmp (msort.c:44)
==297370==    by 0x48A5A55: qsort_r (msort.c:296)
==297370==    by 0x16DECE: disassemble_data (in /binutils/binutils/objdump)
==297370==    by 0x171908: dump_bfd (in /binutils/binutils/objdump)
==297370==    by 0x171AE0: display_object_bfd (in /binutils/binutils/objdump)
==297370==    by 0x171D4E: display_any_bfd (in /binutils/binutils/objdump)
==297370==    by 0x171DC7: display_file (in /binutils/binutils/objdump)
==297370==
...
<Many similar reports, see attached full logs>
...

```

System environment:

```
[afl++ amdsuplus3] /binutils (master) # gcc --version
gcc (Ubuntu 11.3.0-1ubuntu1~22.04) 11.3.0
Copyright (C) 2021 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

[afl++ amdsuplus3] /binutils (master) # g++ --version
g++ (Ubuntu 11.3.0-1ubuntu1~22.04) 11.3.0
Copyright (C) 2021 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

[afl++ amdsuplus3] /binutils (master) # cat /etc/issue
Ubuntu 22.04.2 LTS \n \l

[afl++ amdsuplus3] /binutils (master) # uname -a
Linux amdsuplus3.inf.ethz.ch 5.4.0-144-generic #161-Ubuntu SMP Fri Feb 3 14:49:04 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
[afl++ amdsuplus3] /binutils (master) #
```
Comment 1 Alan Modra 2023-04-12 01:27:33 UTC
Nasty, a compressed reloc section.  BFD doesn't support them.  It might be possible to do so.  At the very least all places using NUM_SHDR_ENTRIES will need changing because sh_size is the compressed size and we'd need the uncompressed size to calculate number of relocs.
Comment 2 Alan Modra 2023-04-12 05:14:28 UTC
Fixed with commit 93c6e8c3c14b.