[Bug binutils/21437] New: heap-buffer-overflow in byte_get_little_endian (binutils/elfcomm.c:148)

[brian.carpenter at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=21437

            Bug ID: 21437
           Summary: heap-buffer-overflow in byte_get_little_endian
                    (binutils/elfcomm.c:148)
           Product: binutils
           Version: 2.28
            Status: UNCONFIRMED
          Severity: critical
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: brian.carpenter at gmail dot com
  Target Milestone: ---

Created attachment 10023
  --> https://sourceware.org/bugzilla/attachment.cgi?id=10023&action=edit
testcase

Triggered in 7a81a73 (27 April 2017). Compiled with afl-clang-fast on Debian 8
x64.

./readelf -a test000

<SNIP>

==19397==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xb6102f5f at
pc 0x08220aaa bp 0xbfc05a38 sp 0xbfc05a2c
READ of size 1 at 0xb6102f5f thread T0
    #0 0x8220aa9 in byte_get_little_endian
/root/binutils2/binutils/elfcomm.c:148:33
    #1 0x817da69 in process_version_sections
/root/binutils2/binutils/readelf.c:10189:18
    #2 0x817da69 in process_object /root/binutils2/binutils/readelf.c:17788
    #3 0x8155cdd in process_file /root/binutils2/binutils/readelf.c:18183:13
    #4 0x8155cdd in main /root/binutils2/binutils/readelf.c:18255
    #5 0xb751b275 in __libc_start_main
/build/glibc-4LXvX6/glibc-2.24/csu/../csu/libc-start.c:291
    #6 0x8060ec7 in _start (/root/binutils2/binutils/readelf+0x8060ec7)

0xb6102f5f is located 1 bytes to the left of 49-byte region
[0xb6102f60,0xb6102f91)
allocated by thread T0 here:
    #0 0x811aa94 in __interceptor_malloc
(/root/binutils2/binutils/readelf+0x811aa94)
    #1 0x8156dba in get_data /root/binutils2/binutils/readelf.c:392:9

SUMMARY: AddressSanitizer: heap-buffer-overflow
/root/binutils2/binutils/elfcomm.c:148:33 in byte_get_little_endian

-- 
You are receiving this mail because:
You are on the CC list for the bug.