Bug 33472 - [BUG] A heap-buffer-overflow in _bfd_elf_parse_eh_frame at elf-eh-frame.c:762
Summary: [BUG] A heap-buffer-overflow in _bfd_elf_parse_eh_frame at elf-eh-frame.c:762
Status: RESOLVED DUPLICATE of bug 33464
Alias: None
Product: binutils
Classification: Unclassified
Component: ld (show other bugs)
Version: 2.45
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-09-22 03:39 UTC by Yifan Zhang
Modified: 2025-11-24 06:25 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed:
Project(s) to access:
ssh public key:

Attachments
POC (2.56 KB, application/x-object)
2025-09-22 03:39 UTC, Yifan Zhang 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Yifan Zhang 2025-09-22 03:39:09 UTC 
Created attachment 16370 [details]
POC

## Description

- Version: Binutils 2.45 with patches in bug 33451, bug 33455, and bug 33457.
- Environment: Ubuntu 20.04.6 LTS, Clang 12.0.0

## Steps to reproduce

export CC="clang"
export CFLAGS="-g -fsanitize=address"
./configure
make -j
./ld/ld-new --gc-sections --no-print-gc-sections -w $POC

## Sanitizer output

==148474==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000478 at pc 0x0000007ae914 bp 0x7ffdb04c7110 sp 0x7ffdb04c7108
READ of size 1 at 0x603000000478 thread T0
    #0 0x7ae913 in _bfd_elf_parse_eh_frame /benchmark/bin/binutils-2.45/bfd/elf-eh-frame.c:762:8
    #1 0x780c01 in bfd_elf_gc_sections /benchmark/bin/binutils-2.45/bfd/elflink.c:14684:4
    #2 0x5131a8 in lang_gc_sections /benchmark/bin/binutils-2.45/ld/ldlang.c:7892:5
    #3 0x50c94d in lang_process /benchmark/bin/binutils-2.45/ld/ldlang.c:8542:3
    #4 0x53ca89 in main /benchmark/bin/binutils-2.45/ld/./ldmain.c:882:3
    #5 0x7f10f0e7c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)
    #6 0x41d6ad in _start (/benchmark/bin/binutils-2.45/ld/ld-new+0x41d6ad)

0x603000000478 is located 0 bytes to the right of 24-byte region [0x603000000460,0x603000000478)
allocated by thread T0 here:
    #0 0x49917d in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x5dcf72 in bfd_malloc /benchmark/bin/binutils-2.45/bfd/libbfd.c:291:9
    #2 0x5c9c41 in bfd_get_full_section_contents /benchmark/bin/binutils-2.45/bfd/compress.c:742:21
    #3 0x6f6cc6 in elf_mmap_section_contents /benchmark/bin/binutils-2.45/bfd/elf.c:14329:14
    #4 0x6acef1 in _bfd_elf_mmap_section_contents /benchmark/bin/binutils-2.45/bfd/elf.c:14341:10
    #5 0x7acec1 in _bfd_elf_parse_eh_frame /benchmark/bin/binutils-2.45/bfd/elf-eh-frame.c:624:3
    #6 0x780c01 in bfd_elf_gc_sections /benchmark/bin/binutils-2.45/bfd/elflink.c:14684:4
    #7 0x5131a8 in lang_gc_sections /benchmark/bin/binutils-2.45/ld/ldlang.c:7892:5
    #8 0x50c94d in lang_process /benchmark/bin/binutils-2.45/ld/ldlang.c:8542:3
    #9 0x53ca89 in main /benchmark/bin/binutils-2.45/ld/./ldmain.c:882:3
    #10 0x7f10f0e7c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)

SUMMARY: AddressSanitizer: heap-buffer-overflow /benchmark/bin/binutils-2.45/bfd/elf-eh-frame.c:762:8 in _bfd_elf_parse_eh_frame
Shadow bytes around the buggy address:
  0x0c067fff8030: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
  0x0c067fff8040: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x0c067fff8050: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
  0x0c067fff8060: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa fd fd
  0x0c067fff8070: fd fa fa fa 00 00 00 fa fa fa fd fd fd fa fa fa
=>0x0c067fff8080: fd fd fd fa fa fa 00 00 00 fa fa fa 00 00 00[fa]
  0x0c067fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==148474==ABORTING

## Credit

Reported by Yifan Zhang, [PLL](https://pl.cs.pku.edu.cn/en/)
Comment 1 Alan Modra 2025-11-24 06:25:16 UTC 
Fixed by the patch applied for pr33464

*** This bug has been marked as a duplicate of bug 33464 ***