https://sourceware.org/bugzilla/show_bug.cgi?id=34442
Bug ID: 34442
Summary: ld: heap-buffer-overflow in cache_bwrite
(bfd/cache.c:436) on malformed ELF with `--gc-sections
-w` — still reproducible at HEAD (cf. bug 33457)
Product: binutils
Version: 2.47
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: 2722900221 at qq dot com
Target Milestone: ---
Created attachment 16866
--> https://sourceware.org/bugzilla/attachment.cgi?id=16866&action=edit
PoC
Summary
Linking a malformed ELF object with `--gc-sections --no-print-gc-sections -w`
triggers a heap-buffer-overflow READ in `cache_bwrite` (`bfd/cache.c:436`). The
section-contents buffer is allocated to the (small) on-disk section size, but
the write path issues `fwrite(from, 1, nbytes, f)` with `nbytes` larger than
the buffer, reading past the end of the 22-byte region.
This is the same crash site as previously-reported bug
33457(`cache_bwrite`/`fwrite`), which at the time was only confirmed to trigger
against binutils 2.45. It still reproduces at HEAD/2.47 — the fix appears
incomplete; `--gc-sections -w` now reaches the same OOB read. Security-relevant
(heap OOB read; potential to escalate depending on surrounding allocation
layout).
- ASAN: `READ of size 32` past the end of a 22-byte region (`[0x...d60,
0x...d76)`).
- Allocation site: `bfd_get_full_section_contents` → `bfd_malloc`
(`bfd/compress.c:763`).
Affected Version
- binutils 2.47 (release tarball, version date `20260726`) — reproduced.
- Originally triaged on dev snapshot `2.47.50.20260722` (commit `640a79623`);
reproduces identically on the 2.47 release.
Reproduction
Build (ASAN):
CC=gcc CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common' \
LDFLAGS='-fsanitize=address' \
./configure --disable-gdb --disable-gdbserver --disable-sim --disable-cet \
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu
MAKEINFO=true
make -j
Run:
export
ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1"
ld --gc-sections --no-print-gc-sections -w -o /dev/null bug_3.o
Error Log
==65016==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x503000000bc6 at pc 0x733d5104008f bp 0x7ffde3070870 sp 0x7ffde3070018
READ of size 32 at 0x503000000bc6 thread T0
#0 __interceptor_fwrite
#1 cache_bwrite /home/user/build/binutils-2.47/bfd/cache.c:436
#2 bfd_write /home/user/build/binutils-2.47/bfd/bfdio.c:417
#3 _bfd_generic_set_section_contents
/home/user/build/binutils-2.47/bfd/libbfd.c:1348
#4 _bfd_elf_set_section_contents
/home/user/build/binutils-2.47/bfd/elf.c:10072
#5 bfd_set_section_contents
/home/user/build/binutils-2.47/bfd/section.c:1509
0x503000000bc6 is located 0 bytes to the right of 22-byte region
[0x503000000bb0,0x503000000bc6)
allocated by thread T0 here:
#0 __interceptor_malloc
#1 bfd_malloc
/home/user/build/binutils-2.47/bfd/libbfd.c:291
#2 bfd_get_full_section_contents
/home/user/build/binutils-2.47/bfd/compress.c:763
SUMMARY: AddressSanitizer: heap-buffer-overflow in __interceptor_fwrite
(cache_bwrite, cache.c:436)
--
You are receiving this mail because:
You are on the CC list for the bug.
