[Bug binutils/29870] New: objdump SEGV in display_debug_lines_decoded dwarf.c:5524

[13579and24680 at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29870

            Bug ID: 29870
           Summary: objdump SEGV in display_debug_lines_decoded
                    dwarf.c:5524
           Product: binutils
           Version: 2.39
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: 13579and24680 at gmail dot com
  Target Milestone: ---

Created attachment 14490
  --> https://sourceware.org/bugzilla/attachment.cgi?id=14490&action=edit
Generated by my fuzzer and afl-tmin

# version

$ ./binutils-gdb/binutils/objdump --version
GNU objdump (GNU Binutils) 2.39.50.20221210
Copyright (C) 2022 Free Software Foundation, Inc.
This program is free software; you may redistribute it under the terms of
the GNU General Public License version 3 or (at your option) any later version.
This program has absolutely no warranty.

---------------------------------------------------------------------
# make

$ git clone git://sourceware.org/git/binutils-gdb.git
$ cd binutils-gdb
$ ./configure
$ make

---------------------------------------------------------------------
# crash

$ ./binutils-gdb/binutils/objdump -WL poc
./binutils-gdb/binutils/objdump: warning: poc has a section extending past end
of file

poc:     file format elf64-little

Contents of the .debug_line section:

./binutils-gdb/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb/binutils/objdump: Warning: Unrecognized form: 0x30
(null):
File name                            Line number    Starting address    View   
Stmt
fish: Job 1, './binutils-gdb/binutils/objdump…' terminated by signal SIGSEGV
(Address boundary error)

---------------------------------------------------------------------
# ASAN report

$ ./binutils-gdb_asan_no_fuzz/binutils/objdump  -WL poc
./binutils-gdb_asan_no_fuzz/binutils/objdump: warning: poc has a section
extending past end of file

poc:     file format elf64-little

Contents of the .debug_line section:

./binutils-gdb_asan_no_fuzz/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb_asan_no_fuzz/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb_asan_no_fuzz/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb_asan_no_fuzz/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb_asan_no_fuzz/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb_asan_no_fuzz/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb_asan_no_fuzz/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb_asan_no_fuzz/binutils/objdump: Warning: Unrecognized form: 0x30
./binutils-gdb_asan_no_fuzz/binutils/objdump: Warning: Unrecognized form: 0x30
(null):
File name                            Line number    Starting address    View   
Stmt
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2950647==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc
0x7fe9cffcc6e5 bp 0x7fffa374a870 sp 0x7fffa3749fe8 T0)
==2950647==The signal is caused by a READ memory access.
==2950647==Hint: address points to the zero page.
    #0 0x7fe9cffcc6e4  (/lib/x86_64-linux-gnu/libc.so.6+0x1886e4)
    #1 0x7fe9d00a390b in __interceptor_strlen
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:352
    #2 0x555ec916594d in display_debug_lines_decoded dwarf.c:5524
    #3 0x555ec9166061 in display_debug_lines dwarf.c:5655
    #4 0x555ec913b8c4 in dump_dwarf_section objdump.c:4396
    #5 0x555ec928a15d in bfd_map_over_sections
/home/a13579/fuzz_binutils-gdb/binutils-gdb_asan_no_fuzz/bfd/section.c:1366
    #6 0x555ec913baf3 in dump_dwarf objdump.c:4434
    #7 0x555ec9142110 in dump_bfd objdump.c:5636
    #8 0x555ec91424e5 in display_object_bfd objdump.c:5715
    #9 0x555ec9142816 in display_any_bfd objdump.c:5801
    #10 0x555ec9142890 in display_file objdump.c:5822
    #11 0x555ec91441b9 in main objdump.c:6230
    #12 0x7fe9cfe68082 in __libc_start_main ../csu/libc-start.c:308
    #13 0x555ec912839d in _start
(/home/a13579/fuzz_binutils-gdb/binutils-gdb_asan_no_fuzz/binutils/objdump+0x13b39d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x1886e4) 
==2950647==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.