[Bug binutils/21591] New: SEGV on unknown address 0x000000000000 in versados_scan

[aadamski at quarkslab dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=21591

            Bug ID: 21591
           Summary: SEGV on unknown address 0x000000000000 in
                    versados_scan
           Product: binutils
           Version: 2.29 (HEAD)
            Status: UNCONFIRMED
          Severity: critical
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: aadamski at quarkslab dot com
  Target Milestone: ---

Hello there,

I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the
ASAN report log ("Output"). Below is the reduced stacktrace with links to the
corresponding source lines on a GitHub mirror.

The command used was `objdump -D <file>`. The compilation flags used were `-g
-O2 -fno-omit-frame-pointer -fsanitize=address
-fno-sanitize-recover=undefined`. The configuration settings used were
`--enable-targets=all --disable-shared`.

Let me know if there is any additional information I can provide.

--

Input: 2304d75a49df935290e0c4edef5779a1.52037608e08ea640c3ff19ec097f9e72.min
Output: 2304d75a49df935290e0c4edef5779a1.52037608e08ea640c3ff19ec097f9e72.txt

Error in "versados_scan": SEGV on unknown address 0x000000000000 (pc
0x00000173e11e bp 0x7fffffffe130 sp 0x7fffffffdda0 T0)
  in versados_scan at bfd/versados.c:538
    (see
https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/versados.c#L538)
  in versados_object_p at bfd/versados.c:645
    (see
https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/versados.c#L645)
  in bfd_check_format_matches at bfd/format.c:311
    (see
https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/format.c#L311)
  in display_object_bfd at binutils/objdump.c:3602
    (see
https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3602)
  in display_any_bfd at binutils/objdump.c:3693
    (see
https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3693)
  in display_file at binutils/objdump.c:3714
    (see
https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
  in main at binutils/objdump.c:4016
    (see
https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)

-- 
You are receiving this mail because:
You are on the CC list for the bug.