readelf: segfaults fuzzing multiple object files
Alan Modra
amodra@gmail.com
Mon Apr 20 01:38:53 GMT 2020
This patch is aimed at fixing a number of oss-fuzz segfaults that
don't reproduce reliably with their current infrastructure, the
problem being that one invocation of readelf is effectively being run
on multiple object files. I believe that these segfaults could be
reliably reproduced with just two fuzzed objects being presented to
readelf, but those inputs are currently not identified by oss-fuzz.
So there is some guesswork involved in this patch. The idea here is
to clear stashed data such as symtab_shndx_list that is processed
using section header info, at the same time that header info is
cleared.
* readelf.c (process_section_headers): Free dynamic symbols etc.
earlier.
diff --git a/binutils/readelf.c b/binutils/readelf.c
index 601e329fdc..d9c9b7ea0c 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -6132,6 +6132,20 @@ process_section_headers (Filedata * filedata)
free (filedata->section_headers);
filedata->section_headers = NULL;
+ free (dynamic_symbols);
+ dynamic_symbols = NULL;
+ num_dynamic_syms = 0;
+ free (dynamic_strings);
+ dynamic_strings = NULL;
+ dynamic_strings_length = 0;
+ free (dynamic_syminfo);
+ dynamic_syminfo = NULL;
+ while (symtab_shndx_list != NULL)
+ {
+ elf_section_list *next = symtab_shndx_list->next;
+ free (symtab_shndx_list);
+ symtab_shndx_list = next;
+ }
if (filedata->file_header.e_shnum == 0)
{
@@ -6186,21 +6200,6 @@ process_section_headers (Filedata * filedata)
/* Scan the sections for the dynamic symbol table
and dynamic string table and debug sections. */
- free (dynamic_symbols);
- dynamic_symbols = NULL;
- num_dynamic_syms = 0;
- free (dynamic_strings);
- dynamic_strings = NULL;
- dynamic_strings_length = 0;
- free (dynamic_syminfo);
- dynamic_syminfo = NULL;
- while (symtab_shndx_list != NULL)
- {
- elf_section_list *next = symtab_shndx_list->next;
- free (symtab_shndx_list);
- symtab_shndx_list = next;
- }
-
eh_addr_size = is_32bit_elf ? 4 : 8;
switch (filedata->file_header.e_machine)
{
--
Alan Modra
Australia Development Lab, IBM
More information about the Binutils
mailing list