[Bug binutils/16723] New: Excessive memory usage

[duretsimon73 at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=16723

            Bug ID: 16723
           Summary: Excessive memory usage
           Product: binutils
           Version: unspecified
            Status: NEW
          Severity: minor
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: duretsimon73 at gmail dot com

Created attachment 7481
  --> https://sourceware.org/bugzilla/attachment.cgi?id=7481&action=edit
File wich cause the bug

Objdump and readelf have bug when handle malformed ELF file, with a bad
.gnu.version_r section.

Objdump use excessive memory when disassembly the malformed ELF file.
Readelf enter in infinite loop (or toooo long) when running with -V option.

readelf -S a.out | grep .gnu.version_r
[ 8] .gnu.version_r    VERNEED         08048914 000914 000080 00   A  6
15335426  4

Here is the backtrace of objdump when running under GDB :
gdb$ bt
#0  bfd_getl32 (p=0x81ad914) at libbfd.c:616
#1  0x080aabd8 in _bfd_elf_swap_verneed_in (address@hidden,
address@hidden, address@hidden) at elf.c:128
#2  0x080b2c94 in _bfd_elf_slurp_version_tables (address@hidden,
address@hidden) at elf.c:7204
#3  0x080a707b in bfd_elf32_slurp_symbol_table (abfd=0x81a7920,
symptrs=0x81ad7d0, dynamic=0x1) at elfcode.h:1159
#4  0x080b251d in _bfd_elf_canonicalize_dynamic_symtab (abfd=0x81a7920,
allocation=0x81ad7d0) at elf.c:7069
#5  0x0804e292 in slurp_dynamic_symtab (abfd=0x81a7920) at ./objdump.c:599
#6  dump_bfd (address@hidden) at ./objdump.c:3231
#7  0x0804f14f in display_object_bfd (abfd=0x81a7920) at ./objdump.c:3312
#8  display_any_bfd (address@hidden, address@hidden) at
./objdump.c:3386
#9  0x08050ecf in display_file (filename=0xbffffce8
"/home/tosh/TOSH_GIT/elfzz/vuln/objdump", target=<optimized out>) at
./objdump.c:3407
#10 0x0804bb90 in main (argc=0x3, argv=0xbffffb64) at ./objdump.c:3689


Here is the backtrace of readelf when running under GDB :
gdb$ bt
#0  0xb7fdd424 in __kernel_vsyscall ()
#1  0xb7ed12d3 in __write_nocancel () from /usr/lib/libc.so.6
#2  0xb7e65191 in _IO_new_file_write () from /usr/lib/libc.so.6
#3  0xb7e643ef in new_do_write () from /usr/lib/libc.so.6
#4  0xb7e6613e in __GI__IO_do_write () from /usr/lib/libc.so.6
#5  0xb7e664dd in __GI__IO_file_overflow () from /usr/lib/libc.so.6
#6  0xb7e6577b in __GI__IO_file_xsputn () from /usr/lib/libc.so.6
#7  0xb7e39bc2 in vfprintf () from /usr/lib/libc.so.6
#8  0xb7e4310f in printf () from /usr/lib/libc.so.6
#9  0x08057ad0 in process_version_sections (address@hidden) at
readelf.c:8908
#10 0x0806ad4f in process_object (address@hidden
"/home/tosh/TOSH_GIT/elfzz/vuln/objdump", address@hidden) at
readelf.c:14275
#11 0x08049751 in process_file (file_name=0xbffffce8
"/home/tosh/TOSH_GIT/elfzz/vuln/objdump") at readelf.c:14648

File wich cause the bug is in attachment, for reproduce :
$ objdump -d a.out
$ readelf -V a.out

-- 
You are receiving this mail because:
You are on the CC list for the bug.