Issue 442253757: elfutils:fuzz-libdwfl: Heap-buffer-overflow in __libelf_set_data_list_rdlock

[buganizer-system@google.com]

Replying to this email means your email address will be shared with the
team that works on this product.
https://issues.oss-fuzz.com/issues/442253757

Reference Info: 442253757 elfutils:fuzz-libdwfl: Heap-buffer-overflow in
__libelf_set_data_list_rdlock
component:  Public Trackers > 1362134 > OSS Fuzz
status:  New
reporter:  87...@developer.gserviceaccount.com
cc:  da...@adalogics.com, elfutils-devel@sourceware.org, ev...@gmail.com,
and 1 more
collaborators:  co...@oss-fuzz.com
type:  Vulnerability
access level:  Default access
priority:  P2
severity:  S2
hotlist:  Reproducible, Stability-Memory-AddressSanitizer
retention:  Component default
Project:  elfutils
Reported:  Aug 31, 2025

87...@developer.gserviceaccount.com added comment #1:
Detailed Report: https://oss-fuzz.com/testcase?key=6310572573655040

Project: elfutils
Fuzzing Engine: libFuzzer
Fuzz Target: fuzz-libdwfl
Job Type: libfuzzer_asan_elfutils
Platform Id: linux

Crash Type: Heap-buffer-overflow READ {*}
Crash Address: 0x780ce98b6000
Crash State:
   __libelf_set_data_list_rdlock
   __elf_getdata_rdlock
   elf_compress_gnu

Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed:
https://oss-fuzz.com/revisions?job=libfuzzer_asan_elfutils&range=202508201802:202508210000

Reproducer Testcase:
https://oss-fuzz.com/download?testcase_id=6310572573655040

Issue filed automatically.

See https://google.github.io/oss-fuzz/advanced-topics/reproducing for
instructions to reproduce this bug locally.
When you fix this bug, please
   * mention the fix revision(s).
   * state whether the bug was a short-lived regression or an old bug in any
stable releases.
   * add any other useful information.
This information can help downstream consumers.

If you need to contact the OSS-Fuzz team with a question, concern, or any
other feedback, please file an issue at
https://github.com/google/oss-fuzz/issues. Comments on individual Monorail
issues are not monitored.


Generated by Google IssueTracker notification system.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://sourceware.org/pipermail/elfutils-devel/attachments/20250831/6f9f3e5a/attachment.htm>