https://sourceware.org/bugzilla/show_bug.cgi?id=28685
--- Comment #5 from Evgeny Vereshchagin <evvers at ya dot ru> --- Created attachment 13867 --> https://sourceware.org/bugzilla/attachment.cgi?id=13867&action=edit regression I ran the fuzzer a bit longer and it seems https://sourceware.org/pipermail/elfutils-devel/2021q4/004562.html introduced a regression: ``` $ LD_LIBRARY_PATH="./libdw;./libelf" ./src/stack --core ../crash-83c981b28f378121157262f840b36f1ba7089a21 ================================================================= ==323325==ERROR: AddressSanitizer: unknown-crash on address 0x7f54aacd7000 at pc 0x0000004c3efa bp 0x7ffd969da5b0 sp 0x7ffd969d9d60 READ of size 2097120 at 0x7f54aacd7000 thread T0 #0 0x4c3ef9 in __asan_memcpy (/home/vagrant/elfutils/src/stack+0x4c3ef9) #1 0x7f54ac1b21f4 in memcpy /usr/include/bits/string_fortified.h:29:10 #2 0x7f54ac1b21f4 in dwfl_segment_report_module /home/vagrant/elfutils/libdwfl/dwfl_segment_report_module.c:466:7 #3 0x7f54ac1c09f8 in dwfl_core_file_report@@ELFUTILS_0.158 /home/vagrant/elfutils/libdwfl/core-file.c:559:17 #4 0x4fe447 in parse_opt /home/vagrant/elfutils/src/stack.c:595:8 #5 0x7f54abbcb471 in argp_parse (/lib64/libc.so.6+0x11e471) #6 0x4fd99d in main /home/vagrant/elfutils/src/stack.c:695:3 #7 0x7f54abada55f in __libc_start_call_main (/lib64/libc.so.6+0x2d55f) #8 0x7f54abada60b in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x2d60b) #9 0x41d6c4 in _start (/home/vagrant/elfutils/src/stack+0x41d6c4) Address 0x7f54aacd7000 is a wild pointer inside of access range of size 0x0000001fffe0. SUMMARY: AddressSanitizer: unknown-crash (/home/vagrant/elfutils/src/stack+0x4c3ef9) in __asan_memcpy Shadow bytes around the buggy address: 0x0feb15592db0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0feb15592dc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0feb15592dd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0feb15592de0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0feb15592df0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0feb15592e00:[fe]fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe 0x0feb15592e10: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe 0x0feb15592e20: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe 0x0feb15592e30: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe 0x0feb15592e40: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe 0x0feb15592e50: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==323325==ABORTING ``` -- You are receiving this mail because: You are on the CC list for the bug.
