https://sourceware.org/bugzilla/show_bug.cgi?id=22955
Bug ID: 22955
Summary: Heap out of bounds read in parse_stab_array_type()
Product: binutils
Version: 2.30
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: binutils
Assignee: unassigned at sourceware dot org
Reporter: fumfi.255 at gmail dot com
Target Milestone: ---
Created attachment 10889
--> https://sourceware.org/bugzilla/attachment.cgi?id=10889&action=edit
Crashing test case (objdump)
After some fuzz testing I found a crashing test case.
Version: 2.30
Command: objdump -x -D -S -s -G -g -e -t -T -r -R
objdump_hoobr_parse_stab_array_type
ASAN Context:
==2449==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000012b1d
at pc 0x000000524449 bp 0x7ffeef745850 sp 0x7ffeef745840
READ of size 1 at 0x621000012b1d thread T0
#0 0x524448 in parse_stab_array_type
XYZ/binutils-2.30.0/binutils/stabs.c:3127
#1 0x524448 in parse_stab_type XYZ/binutils-2.30.0/binutils/stabs.c:1577
#2 0x5318b0 in parse_stab_string XYZ/binutils-2.30.0/binutils/stabs.c:968
#3 0x5318b0 in parse_stab XYZ/binutils-2.30.0/binutils/stabs.c:655
#4 0x4ebd89 in read_section_stabs_debugging_info
XYZ/binutils-2.30.0/binutils/rddbg.c:239
#5 0x4ebd89 in read_debugging_info XYZ/binutils-2.30.0/binutils/rddbg.c:56
#6 0x41f654 in dump_bfd objdump.c:3607
#7 0x421a77 in display_object_bfd objdump.c:3658
#8 0x421a77 in display_any_bfd objdump.c:3747
#9 0x40ea81 in display_file objdump.c:3768
#10 0x40ea81 in main objdump.c:4070
#11 0x7f2bbf8db82f in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#12 0x411ca8 in _start (/usr/local/bin/objdump+0x411ca8)
0x621000012b1d is located 0 bytes to the right of 4637-byte region
[0x621000011900,0x621000012b1d)
allocated by thread T0 here:
#0 0x7f2bbff21602 in malloc
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
#1 0xb57fec in xmalloc xmalloc.c:147
SUMMARY: AddressSanitizer: heap-buffer-overflow
XYZ/binutils-2.30.0/binutils/stabs.c:3127 parse_stab_array_type
Shadow bytes around the buggy address:
0x0c427fffa510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffa520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffa530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffa540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffa550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c427fffa560: 00 00 00[05]fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffa570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffa580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffa590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffa5a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c427fffa5b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==2449==ABORTING
--
You are receiving this mail because:
You are on the CC list for the bug.
_______________________________________________
bug-binutils mailing list
bug-binutils@gnu.org
https://lists.gnu.org/mailman/listinfo/bug-binutils
