[Bug binutils/21641] New: SEGV on unknown address in setup_sections

[aadamski at quarkslab dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=21641

            Bug ID: 21641
           Summary: SEGV on unknown address in setup_sections
           Product: binutils
           Version: 2.29 (HEAD)
            Status: UNCONFIRMED
          Severity: critical
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: aadamski at quarkslab dot com
  Target Milestone: ---

Hello there,

I have been fuzzing objdump with American Fuzzy Lop + ASAN/UBSAN.

Please find attached the minimized file causing the issue ("Input") and the
ASAN report log ("Output"). Below is the reduced stacktrace with links to the
corresponding source lines on a GitHub mirror.

The configuration settings used were `--enable-targets=all --disable-shared`.
The compilation flags used were `-g -O2 -fno-omit-frame-pointer
-fsanitize=address -fno-sanitize-recover=all`. The command used was `objdump
-afpxDSsgetTrR <file>`.

Let me know if there is any additional information I can provide.

--

Input: ad5b18e3ab2e99645d454bd218e7e425.4a145a99483654b79949d806705c075c.min
Output: ad5b18e3ab2e99645d454bd218e7e425.4a145a99483654b79949d806705c075c.txt

Error in "setup_sections": SEGV on unknown address 0x611002960648 (pc
0x7ffff6f72c3a bp 0x7fffffffdc90 sp 0x7fffffffd418 T0)
  in setup_sections at bfd/som.c:2125
    (see
https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/bfd/som.c#L2125)
  in som_object_p at bfd/som.c:2511
    (see
https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/bfd/som.c#L2511)
  in bfd_check_format_matches at bfd/format.c:311
    (see
https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/bfd/format.c#L311)
  in display_object_bfd at binutils/objdump.c:3608
    (see
https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/binutils/objdump.c#L3608)
  in display_any_bfd at binutils/objdump.c:3699
    (see
https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/binutils/objdump.c#L3699)
  in display_file at binutils/objdump.c:3720
    (see
https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/binutils/objdump.c#L3720)
  in main at binutils/objdump.c:4024
    (see
https://github.com/bminor/binutils-gdb/blob/a6cab9afd2c81465265c8d09569e3e6ef43d2954/binutils/objdump.c#L4024)

-- 
You are receiving this mail because:
You are on the CC list for the bug.