bug-binutils
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Bug binutils/23143] New: objcopy: SIGSEGV in htab_hash_string


From: paolo.montesel+sourceware at gmail dot com
Subject: [Bug binutils/23143] New: objcopy: SIGSEGV in htab_hash_string
Date: Fri, 04 May 2018 23:45:43 +0000

https://sourceware.org/bugzilla/show_bug.cgi?id=23143

            Bug ID: 23143
           Summary: objcopy: SIGSEGV in htab_hash_string
           Product: binutils
           Version: 2.31 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: paolo.montesel+sourceware at gmail dot com
  Target Milestone: ---

Created attachment 10995
  --> https://sourceware.org/bugzilla/attachment.cgi?id=10995&action=edit
crash

As part of a tool I'm writing I fuzzed binutils. The attached file makes
objcopy crash inside `htab_hash_string`:

Program received signal SIGSEGV, Segmentation fault.
htab_hash_string (p=0xde89483b74ff8548) at ./hashtab.c:838
838       while ((c = *str++) != 0)
#0  htab_hash_string (p=0xde89483b74ff8548) at ./hashtab.c:838
#1  0x00000000004c7151 in htab_find (htab=0x72e1c0, element=0xde89483b74ff8548)
at ./hashtab.c:621
#2  0x000000000040685c in is_specified_symbol (name=<optimized out>,
htab=<optimized out>) at objcopy.c:1195
#3  0x0000000000406904 in is_strip_section (address@hidden,
abfd=0x72ef40) at objcopy.c:1357
#4  0x0000000000406db5 in skip_section (ibfd=0x72ef40, isection=0x730950,
skip_copy=1) at objcopy.c:3849
#5  0x0000000000406e4f in copy_section (ibfd=0x72ef40, isection=0x730950,
obfdarg=0x7322e0) at objcopy.c:4026
#6  0x000000000042639c in bfd_map_over_sections (address@hidden,
address@hidden <copy_section>,
address@hidden) at section.c:1391
#7  0x0000000000408864 in copy_object (ibfd=<optimized out>, obfd=<optimized
out>, input_arch=<optimized out>) at objcopy.c:3057
#8  0x000000000040a63a in copy_file
(address@hidden "id:000011,sig:1"...,
address@hidden "/dev/null",
address@hidden, output_target=<optimized out>,
address@hidden, address@hidden) at objcopy.c:3532
#9  0x0000000000403334 in copy_main (argv=<optimized out>, argc=<optimized
out>) at objcopy.c:5484
#10 main (address@hidden, address@hidden) at objcopy.c:5588
#11 0x00007ffff7829830 in __libc_start_main (main=0x402ea0 <main>, argc=3,
argv=0x7fffffffdd98, init=<optimized out>, fini=<optimized out>,
rtld_fini=<optimized out>, stack_end=0x7fffffffdd88) at ../csu/libc-start.c:291
#12 0x00000000004055c9 in _start ()

Compiled and tried against a freshly cloned repo. It also works on Ubuntu
Xenial's binutils (2.26.1). X86_64 machine.

-- 
You are receiving this mail because:
You are on the CC list for the bug.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]