bug-binutils
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Bug binutils/26809] New: nm-new : heap-buffer-overflow in bfd_getl_sign


From: zodf0055980 at gmail dot com
Subject: [Bug binutils/26809] New: nm-new : heap-buffer-overflow in bfd_getl_signed_64
Date: Thu, 29 Oct 2020 12:22:09 +0000

https://sourceware.org/bugzilla/show_bug.cgi?id=26809

            Bug ID: 26809
           Summary: nm-new : heap-buffer-overflow in bfd_getl_signed_64
           Product: binutils
           Version: 2.36 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: zodf0055980 at gmail dot com
  Target Milestone: ---

Created attachment 12928
  --> https://sourceware.org/bugzilla/attachment.cgi?id=12928&action=edit
file that reproduces this problem

OS : ubuntu 18.04.3
kernel : gnu/linux 5.4.0-52-generic
CPU : Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz
compiler : gcc version 7.5.0

Steps to Reproduce :
download the sample from attachment

~/binutils-ASAN/binutils/nm-new -D --synthetic ./sample

/home/yuan/binutils-ASAN/binutils/nm-new: ./sample(.rela.plt): relocation 0 has
invalid symbol index 6
/home/yuan/binutils-ASAN/binutils/nm-new: ./sample: unsupported relocation type
0xf8
=================================================================
==1587==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000247
at pc 0x5635ebbcfbd8 bp 0x7ffeb201d870 sp 0x7ffeb201d860
READ of size 1 at 0x604000000247 thread T0
    #0 0x5635ebbcfbd7 in bfd_getl_signed_64
/home/yuan/binutils-ASAN/bfd/libbfd.c:752
    #1 0x5635ebc82b61 in bfd_elf64_swap_reloca_in
/home/yuan/binutils-ASAN/bfd/elfcode.h:432
    #2 0x5635ebd3597a in _bfd_elf_slurp_secondary_reloc_section
/home/yuan/binutils-ASAN/bfd/elf.c:12635
    #3 0x5635ebc8c95f in bfd_elf64_slurp_reloc_table
/home/yuan/binutils-ASAN/bfd/elfcode.h:1606
    #4 0x5635ebd08299 in _bfd_elf_canonicalize_dynamic_reloc
/home/yuan/binutils-ASAN/bfd/elf.c:8654
    #5 0x5635ebc72dbc in _bfd_x86_elf_get_synthetic_symtab
/home/yuan/binutils-ASAN/bfd/elfxx-x86.c:2111
    #6 0x5635ebc2fa6b in elf_x86_64_get_synthetic_symtab
/home/yuan/binutils-ASAN/bfd/elf64-x86-64.c:4918
    #7 0x5635ebb7b0e3 in display_rel_file
/home/yuan/binutils-ASAN/binutils/nm.c:1161
    #8 0x5635ebb7db8b in display_file
/home/yuan/binutils-ASAN/binutils/nm.c:1381
    #9 0x5635ebb72d73 in main /home/yuan/binutils-ASAN/binutils/nm.c:1865
    #10 0x7f7846ed8b96 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #11 0x5635ebb74ed9 in _start
(/home/yuan/binutils-ASAN/binutils/nm-new+0xaced9)

0x604000000247 is located 7 bytes to the right of 48-byte region
[0x604000000210,0x604000000240)
allocated by thread T0 here:
    #0 0x7f784758ab40 in __interceptor_malloc
(/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40)
    #1 0x5635ebbcc9a7 in bfd_malloc /home/yuan/binutils-ASAN/bfd/libbfd.c:275

SUMMARY: AddressSanitizer: heap-buffer-overflow
/home/yuan/binutils-ASAN/bfd/libbfd.c:752 in bfd_getl_signed_64
Shadow bytes around the buggy address:
  0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff8000: fa fa 00 00 00 00 01 fa fa fa fd fd fd fd fd fd
  0x0c087fff8010: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
  0x0c087fff8020: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
  0x0c087fff8030: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 00
=>0x0c087fff8040: fa fa 00 00 00 00 00 00[fa]fa fd fd fd fd fd fd
  0x0c087fff8050: fa fa 00 00 00 00 00 03 fa fa 00 00 00 00 00 fa
  0x0c087fff8060: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
  0x0c087fff8070: fa fa fd fd fd fd fd fa fa fa fa fa fa fa fa fa
  0x0c087fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1587==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]