[Bug binutils/28179] New: Segment fault on `nm-new -a`

[shaohua.li at inf dot ethz.ch]

https://sourceware.org/bugzilla/show_bug.cgi?id=28179

            Bug ID: 28179
           Summary: Segment fault on `nm-new -a`
           Product: binutils
           Version: 2.38 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: shaohua.li at inf dot ethz.ch
  Target Milestone: ---

Created attachment 13588
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13588&action=edit
poc

Hi there,

I crashed `nm-new -a` with a fuzzer.

- binutils version: 2.38(Head), commit af51804103a08cd1e12edc4f4a30eec2c5c4f9e8
- Compiler: clang12
- Platform: Ubuntu 18.04.5 LTS, x86_64
- Reproduce: run `nm-new -a poc`

AddressSanitizer report:

==685==ERROR: AddressSanitizer: SEGV on unknown address 0x602000010004 (pc
0x7f1da2fadfaa bp 0x000000000000 sp 0x7ffcde24b910 T0)
==685==The signal is caused by a READ memory access.
    #0 0x7f1da2fadfaa  (/out_bin/../lib/bfd-plugins/liblto_plugin.so+0xffaa)
    #1 0x7f1da2fa34d8  (/out_bin/../lib/bfd-plugins/liblto_plugin.so+0x54d8)
    #2 0x7e4eae in try_claim /binutils_latest/repo/bfd/plugin.c:323:7
    #3 0x7e3f07 in try_load_plugin /binutils_latest/repo/bfd/plugin.c:427:8
    #4 0x7e35f8 in load_plugin /binutils_latest/repo/bfd/plugin.c:563:9
    #5 0x7e2a50 in bfd_plugin_object_p
/binutils_latest/repo/bfd/plugin.c:576:53
    #6 0x4fc4d9 in bfd_check_format_matches
/binutils_latest/repo/bfd/format.c:277:17
    #7 0x4c977e in display_file /binutils_latest/repo/binutils/nm.c:1442:12
    #8 0x4c90db in main /binutils_latest/repo/binutils/nm.c:1965:12
    #9 0x7f1da5de40b2 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #10 0x41c55d in _start (/out_bin/nm-new+0x41c55d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
(/out_bin/../lib/bfd-plugins/liblto_plugin.so+0xffaa) 
==685==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.