[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Bug binutils/24049] heap-use-after-free in readelf
|
From: |
0x0keeper at gmail dot com |
|
Subject: |
[Bug binutils/24049] heap-use-after-free in readelf |
|
Date: |
Mon, 31 Dec 2018 15:11:00 +0000 |
https://sourceware.org/bugzilla/show_bug.cgi?id=24049
--- Comment #1 from zerokeeper <0x0keeper at gmail dot com> ---
update,the first AddressSanitizer don't show code symbolize.i rebuild.
this is symbolize on the stack traces.
readelf: Error:
=================================================================
==24023==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300000ef50
at pc 0x7f196b4121e9 bp 0x7ffc894f6a00 sp 0x7ffc894f6178
READ of size 2 at 0x60300000ef50 thread T0
#0 0x7f196b4121e8 (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x601e8)
#1 0x7f196b412bcc in vfprintf
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x60bcc)
#2 0x5420b6 in error /root/fuzz/binutils-2.31/binutils/elfcomm.c:43
#3 0x4a6311 in process_archive
/root/fuzz/binutils-2.31/binutils/readelf.c:19092
#4 0x404397 in process_file
/root/fuzz/binutils-2.31/binutils/readelf.c:19247
#5 0x404397 in main /root/fuzz/binutils-2.31/binutils/readelf.c:19318
#6 0x7f196b00882f in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#7 0x404f78 in _start (/root/fuzz/binutils-2.31/binutils/readelf+0x404f78)
0x60300000ef50 is located 0 bytes inside of 19-byte region
[0x60300000ef50,0x60300000ef63)
freed by thread T0 here:
#0 0x7f196b44a2ca in __interceptor_free
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
#1 0x4a55ee in process_archive
/root/fuzz/binutils-2.31/binutils/readelf.c:19178
previously allocated by thread T0 here:
#0 0x7f196b44a602 in malloc
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
#1 0x54b194 in make_qualified_name
/root/fuzz/binutils-2.31/binutils/elfcomm.c:906
SUMMARY: AddressSanitizer: heap-use-after-free ??:0 ??
Shadow bytes around the buggy address:
0x0c067fff9d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fd fd
=>0x0c067fff9de0: fd fa fa fa fd fd fd fd fa fa[fd]fd fd fa fa fa
0x0c067fff9df0: fd fd fd fa fa fa 00 00 01 fa fa fa 00 00 00 fa
0x0c067fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==24023==ABORTING
--
You are receiving this mail because:
You are on the CC list for the bug.