Bug 33464 - [BUG] A heap-buffer-overflow in _bfd_elf_parse_eh_frame at elf-eh-frame.c:756
Summary: [BUG] A heap-buffer-overflow in _bfd_elf_parse_eh_frame at elf-eh-frame.c:756
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: ld (show other bugs)
Version: 2.45
: P2 normal
Target Milestone: 2.46
Assignee: Not yet assigned to anyone
URL:
Keywords:
: 33472 (view as bug list)
Depends on:
Blocks:
 
Reported: 2025-09-19 12:52 UTC by Yifan Zhang
Modified: 2025-11-24 06:25 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed:
Project(s) to access:
ssh public key:

Attachments
POC (2.61 KB, application/x-object)
2025-09-19 12:52 UTC, Yifan Zhang 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Yifan Zhang 2025-09-19 12:52:24 UTC 
Created attachment 16358 [details]
POC

## Description

- Version: Binutils 2.45 with patches in bug 33451, bug 33455, and bug 33457.
- Environment: Ubuntu 20.04.6 LTS, Clang 12.0.0

## Steps to reproduce

export CC="clang"
export CFLAGS="-g -fsanitize=address"
./configure
make -j
./ld/ld-new --gc-sections --no-print-gc-sections -w $POC

## Sanitizer output

==144772==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030000002f8 at pc 0x00000042fe89 bp 0x7ffc9d116ef0 sp 0x7ffc9d1166b0
READ of size 16 at 0x6030000002f8 thread T0
    #0 0x42fe88 in strlen /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:372:5
    #1 0x7ae4cd in _bfd_elf_parse_eh_frame /benchmark/bin/binutils-2.45/bfd/elf-eh-frame.c:756:4
    #2 0x786e7c in bfd_elf_discard_info /benchmark/bin/binutils-2.45/bfd/elflink.c:15228:4
    #3 0x570be0 in gldelf_x86_64_after_allocation /benchmark/bin/binutils-2.45/ld/eelf_x86_64.c:179:21
    #4 0x554ab7 in ldemul_after_allocation /benchmark/bin/binutils-2.45/ld/ldemul.c:98:3
    #5 0x50d017 in lang_process /benchmark/bin/binutils-2.45/ld/ldlang.c:8642:3
    #6 0x53ca89 in main /benchmark/bin/binutils-2.45/ld/./ldmain.c:882:3
    #7 0x7f417accf082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)
    #8 0x41d6ad in _start (/benchmark/bin/binutils-2.45/ld/ld-new+0x41d6ad)

0x6030000002f8 is located 0 bytes to the right of 24-byte region [0x6030000002e0,0x6030000002f8)
allocated by thread T0 here:
    #0 0x49917d in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x5dcf72 in bfd_malloc /benchmark/bin/binutils-2.45/bfd/libbfd.c:291:9
    #2 0x5c9c41 in bfd_get_full_section_contents /benchmark/bin/binutils-2.45/bfd/compress.c:742:21
    #3 0x6f6cc6 in elf_mmap_section_contents /benchmark/bin/binutils-2.45/bfd/elf.c:14329:14
    #4 0x6acef1 in _bfd_elf_mmap_section_contents /benchmark/bin/binutils-2.45/bfd/elf.c:14341:10
    #5 0x7acec1 in _bfd_elf_parse_eh_frame /benchmark/bin/binutils-2.45/bfd/elf-eh-frame.c:624:3
    #6 0x786e7c in bfd_elf_discard_info /benchmark/bin/binutils-2.45/bfd/elflink.c:15228:4
    #7 0x570be0 in gldelf_x86_64_after_allocation /benchmark/bin/binutils-2.45/ld/eelf_x86_64.c:179:21
    #8 0x554ab7 in ldemul_after_allocation /benchmark/bin/binutils-2.45/ld/ldemul.c:98:3
    #9 0x50d017 in lang_process /benchmark/bin/binutils-2.45/ld/ldlang.c:8642:3
    #10 0x53ca89 in main /benchmark/bin/binutils-2.45/ld/./ldmain.c:882:3
    #11 0x7f417accf082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)

SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:372:5 in strlen
Shadow bytes around the buggy address:
  0x0c067fff8000: fa fa 00 00 00 03 fa fa 00 00 00 fa fa fa 00 00
  0x0c067fff8010: 02 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x0c067fff8020: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
  0x0c067fff8030: fa fa 00 00 00 fa fa fa fd fd fd fa fa fa 00 00
  0x0c067fff8040: 00 fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
=>0x0c067fff8050: 00 00 00 fa fa fa fd fd fd fa fa fa 00 00 00[fa]
  0x0c067fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==144772==ABORTING

## Credit

Reported by Yifan Zhang, [PLL](https://pl.cs.pku.edu.cn/en/)
Comment 1 Yifan Zhang 2025-09-19 12:53:24 UTC 
Sorry for my mistake, the command should be ./ld/ld-new --no-undefined --orphan-handling discard -w -r -d $POC
Comment 2 Sourceware Commits 2025-09-22 21:04:35 UTC 
The master branch has been updated by H.J. Lu <hjl@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea1a0737c7692737a644af0486b71e4a392cbca8

commit ea1a0737c7692737a644af0486b71e4a392cbca8
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Mon Sep 22 15:20:34 2025 +0800

    elf: Don't read beyond .eh_frame section size
    
            PR ld/33464
            * elf-eh-frame.c (_bfd_elf_parse_eh_frame): Don't read beyond
            .eh_frame section size.
    
    Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
Comment 3 H.J. Lu 2025-09-22 21:22:16 UTC 
Fixed for 2.46.
Comment 4 Alan Modra 2025-11-24 06:25:16 UTC 
*** Bug 33472 has been marked as a duplicate of this bug. ***