Bug 33050 - objcopy crashes due to heap corruption caused by a negative-size memset in bfd_elf_set_group_contents.
Summary: objcopy crashes due to heap corruption caused by a negative-size memset in bf...
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.45
: P2 normal
Target Milestone: 2.45
Assignee: H.J. Lu
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-06-03 07:42 UTC by arthur
Modified: 2025-06-23 14:32 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed: 2025-06-21 00:00:00
Project(s) to access:
ssh public key:
dragonarthurx: security?

Attachments
poc file (3.17 KB, application/x-object)
2025-06-03 07:42 UTC, arthur 		Details
A patch (667 bytes, patch)
2025-06-21 22:55 UTC, H.J. Lu 		Details | Diff
A patch (934 bytes, patch)
2025-06-21 22:56 UTC, H.J. Lu 		Details | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description arthur 2025-06-03 07:42:21 UTC 
Created attachment 16118 [details]
poc file

Step to Reproduce:
git clone https://gitlab.com/gnutools/binutils-gdb.git
cd binutils-gdb
mkdir build
cd build
export CC=/root/go/bin/gclang 
export CXX=/root/go/bin/gclang++ 
export CFLAGS="-g -O0 -fno-discard-value-names -fsanitize=address"  
export CXXFLAGS="-g -O0 -fno-discard-value-names -fsanitize=address" 
../configure --disable-shared --disable-gdb --disable-gdbserver --disable-gdbsupport --disable-gnulib --disable-libdecnumber --disable-gas --disable-gdb --disable-ld --disable-gold --disable-sim --disable-gprof --disable-gprofing --disable-gprofng
make -j

binutils/objcopy -S -g -b 0 -i 4 /home/poc /tmp/output.o

binutils/objcopy: BFD (GNU Binutils) 2.44.50.20250603 assertion fail ../../bfd/elf.c:3957
=================================================================
==69364==ERROR: AddressSanitizer: negative-size-param: (size=-18)
    #0 0x498399 in __asan_memset (/home/binutils-gdb/build/binutils/objcopy+0x498399)
    #1 0x63adec in bfd_elf_set_group_contents /home/binutils-gdb/build/bfd/../../bfd/elf.c:3958:4
    #2 0x576a9a in bfd_map_over_sections /home/binutils-gdb/build/bfd/../../bfd/section.c:1387:5
    #3 0x63c0b3 in _bfd_elf_compute_section_file_positions /home/binutils-gdb/build/bfd/../../bfd/elf.c:4642:7
    #4 0x65d5e1 in _bfd_elf_set_section_contents /home/binutils-gdb/build/bfd/../../bfd/elf.c:9965:12
    #5 0x577028 in bfd_set_section_contents /home/binutils-gdb/build/bfd/../../bfd/section.c:1527:7
    #6 0x4e474f in copy_section /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4677:12
    #7 0x4da989 in copy_object /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:3408:10
    #8 0x4d4540 in copy_file /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4028:10
    #9 0x4cf4b0 in copy_main /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6187:3
    #10 0x4cadef in main /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6291:5
    #11 0x7f715e122082 in __libc_start_main /build/glibc-FcRMwW/glibc-2.31/csu/../csu/libc-start.c:308:16
    #12 0x41c58d in _start (/home/binutils-gdb/build/binutils/objcopy+0x41c58d)

0x62100001306c is located 876 bytes inside of 4064-byte region [0x621000012d00,0x621000013ce0)
allocated by thread T0 here:
    #0 0x498d3d in __interceptor_malloc (/home/binutils-gdb/build/binutils/objcopy+0x498d3d)
    #1 0x9577f6 in _objalloc_alloc /home/binutils-gdb/build/libiberty/../../libiberty/objalloc.c:159:41
    #2 0x569770 in bfd_alloc /home/binutils-gdb/build/bfd/../../bfd/libbfd.c:453:9
    #3 0x56982c in bfd_zalloc /home/binutils-gdb/build/bfd/../../bfd/libbfd.c:478:9
    #4 0x6416b0 in assign_section_numbers /home/binutils-gdb/build/bfd/../../bfd/elf.c:4142:36
    #5 0x63be83 in _bfd_elf_compute_section_file_positions /home/binutils-gdb/build/bfd/../../bfd/elf.c:4622:8
    #6 0x65d5e1 in _bfd_elf_set_section_contents /home/binutils-gdb/build/bfd/../../bfd/elf.c:9965:12
    #7 0x577028 in bfd_set_section_contents /home/binutils-gdb/build/bfd/../../bfd/section.c:1527:7
    #8 0x4e474f in copy_section /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4677:12
    #9 0x4da989 in copy_object /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:3408:10
    #10 0x4d4540 in copy_file /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4028:10
    #11 0x4cf4b0 in copy_main /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6187:3
    #12 0x4cadef in main /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6291:5
    #13 0x7f715e122082 in __libc_start_main /build/glibc-FcRMwW/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: negative-size-param (/home/binutils-gdb/build/binutils/objcopy+0x498399) in __asan_memset
==69364==ABORTING
Comment 1 H.J. Lu 2025-06-21 22:55:48 UTC 
Created attachment 16145 [details]
A patch
Comment 2 H.J. Lu 2025-06-21 22:56:35 UTC 
Created attachment 16146 [details]
A patch
Comment 3 Sourceware Commits 2025-06-23 14:30:47 UTC 
The master branch has been updated by H.J. Lu <hjl@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=41461010eb7c79fee7a9d5f6209accdaac66cc6b

commit 41461010eb7c79fee7a9d5f6209accdaac66cc6b
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Sat Jun 21 06:52:00 2025 +0800

    elf: Report corrupted group section
    
    Report corrupted group section instead of trying to recover.
    
            PR binutils/33050
            * elf.c (bfd_elf_set_group_contents): Report corrupted group
            section.
    
    Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
Comment 4 H.J. Lu 2025-06-23 14:32:14 UTC 
Fixed for 2.45.