[Bug backends/23529] New: heap-buffer-overflow in eu-readelf

wcventure at 126 dot com sourceware-bugzilla@sourceware.org
Wed Aug 15 13:14:00 GMT 2018


https://sourceware.org/bugzilla/show_bug.cgi?id=23529

            Bug ID: 23529
           Summary: heap-buffer-overflow in eu-readelf
           Product: elfutils
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: backends
          Assignee: unassigned at sourceware dot org
          Reporter: wcventure at 126 dot com
                CC: elfutils-devel at sourceware dot org
  Target Milestone: ---

Created attachment 11186
  --> https://sourceware.org/bugzilla/attachment.cgi?id=11186&action=edit
crash-seed-buffer-over-flow

when executing "./eu-readelf -aAdehIlnrsSVcp -w @@", AddressSanitizer catch a
heap-buffer-overflow carsh.

==29317==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60600000c536 at pc 0x7f5bdaf2bfb0 bp 0x7ffff669ef70 sp 0x7ffff669ef60
READ of size 1 at 0x60600000c536 thread T0
    #0 0x7f5bdaf2bfaf in __libdw_get_uleb128_unchecked
/mnt/d/Project/elfutils/libdw/memory-access.h:97
    #1 0x7f5bdaf2bfaf in dwarf_getabbrevattr_data
/mnt/d/Project/elfutils/libdw/dwarf_getabbrevattr.c:60
    #2 0x42f8c2 in print_debug_abbrev_section
/mnt/d/Project/elfutils/src/readelf.c:5045
    #3 0x45313f in print_debug /mnt/d/Project/elfutils/src/readelf.c:11143
    #4 0x45b07b in process_elf_file /mnt/d/Project/elfutils/src/readelf.c:996
    #5 0x462344 in process_dwflmod /mnt/d/Project/elfutils/src/readelf.c:760
    #6 0x7f5bdafcc410 in dwfl_getmodules
/mnt/d/Project/elfutils/libdwfl/dwfl_getmodules.c:86
    #7 0x40f013 in process_file /mnt/d/Project/elfutils/src/readelf.c:868
    #8 0x405614 in main /mnt/d/Project/elfutils/src/readelf.c:350
    #9 0x7f5bda65082f in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #10 0x406118 in _start
(/mnt/d/Project/elfutils/build/bin/eu-readelf+0x406118)

0x60600000c536 is located 0 bytes to the right of 54-byte region
[0x60600000c500,0x60600000c536)
allocated by thread T0 here:
    #0 0x7f5bdb328602 in malloc
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x7f5bdac62680 in convert_data
/mnt/d/Project/elfutils/libelf/elf_getdata.c:164
    #2 0x7f5bdac62680 in __libelf_set_data_list_rdlock
/mnt/d/Project/elfutils/libelf/elf_getdata.c:431

SUMMARY: AddressSanitizer: heap-buffer-overflow
/mnt/d/Project/elfutils/libdw/memory-access.h:97 __libdw_get_uleb128_unchecked
Shadow bytes around the buggy address:
  0x0c0c7fff9850: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x0c0c7fff9860: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c7fff9870: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c7fff9880: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x0c0c7fff9890: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
=>0x0c0c7fff98a0: 00 00 00 00 00 00[06]fa fa fa fa fa fd fd fd fd
  0x0c0c7fff98b0: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x0c0c7fff98c0: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c7fff98d0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c7fff98e0: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x0c0c7fff98f0: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==29317==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.


More information about the Elfutils-devel mailing list