[Bug binutils/28048] New: heap-buffer-overflow on `readelf -Ww`

[shaohua.li at inf dot ethz.ch]

https://sourceware.org/bugzilla/show_bug.cgi?id=28048

            Bug ID: 28048
           Summary: heap-buffer-overflow on `readelf -Ww`
           Product: binutils
           Version: 2.37 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: shaohua.li at inf dot ethz.ch
  Target Milestone: ---

Created attachment 13526
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13526&action=edit
poc

Hi there,

I crashed `readelf -Ww` with a fuzzer. There is a heap-buffer-overflow in
printf_common. (See details below)

- Compiler: clang12
- Platform: Ubuntu 18.04.5 LTS, x86_64
- Reproduce: run `readelf -Ww poc`

The AddressSanitizer report:

==111713==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60e0000000de at pc 0x000000439d78 bp 0x7ffe03ee78e0 sp 0x7ffe03ee7060
READ of size 1 at 0x60e0000000de thread T0
    #0 0x439d77 in printf_common(void*, char const*, __va_list_tag*)
(/out_bin/readelf+0x439d77)
    #1 0x43b0be in printf (/out_bin/readelf+0x43b0be)
    #2 0x588e66 in get_type_signedness /readelf/repo/binutils/dwarf.c
    #3 0x585053 in read_and_display_attr_value
/readelf/repo/binutils/dwarf.c:2970:8
    #4 0x554cce in read_and_display_attr /readelf/repo/binutils/dwarf.c:3344:10
    #5 0x554cce in process_debug_info /readelf/repo/binutils/dwarf.c:3956:15
    #6 0x56731b in display_debug_info /readelf/repo/binutils/dwarf.c:7155:10
    #7 0x4feabb in display_debug_section
/readelf/repo/binutils/readelf.c:15690:18
    #8 0x4feabb in process_section_contents
/readelf/repo/binutils/readelf.c:15785:10
    #9 0x4dae6f in process_object /readelf/repo/binutils/readelf.c:21514:9
    #10 0x4cb6ed in process_file /readelf/repo/binutils/readelf.c:21939:13
    #11 0x4cb6ed in main /readelf/repo/binutils/readelf.c:22010:11
    #12 0x7f7fca356bf6 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #13 0x41bfa9 in _start (/out_bin/readelf+0x41bfa9)

0x60e0000000de is located 0 bytes to the right of 158-byte region
[0x60e000000040,0x60e0000000de)
allocated by thread T0 here:
    #0 0x496e6d in malloc (/out_bin/readelf+0x496e6d)
    #1 0x6ac52a in xmalloc /readelf/repo/libiberty/./xmalloc.c:147:12
    #2 0x4c9a1a in load_specific_debug_section
/readelf/repo/binutils/readelf.c:15382:8
    #3 0x4fea79 in display_debug_section
/readelf/repo/binutils/readelf.c:15684:8
    #4 0x4fea79 in process_section_contents
/readelf/repo/binutils/readelf.c:15785:10
    #5 0x4dae6f in process_object /readelf/repo/binutils/readelf.c:21514:9
    #6 0x4cb6ed in process_file /readelf/repo/binutils/readelf.c:21939:13
    #7 0x4cb6ed in main /readelf/repo/binutils/readelf.c:22010:11
    #8 0x7f7fca356bf6 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/out_bin/readelf+0x439d77) in
printf_common(void*, char const*, __va_list_tag*)
Shadow bytes around the buggy address:
  0x0c1c7fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
=>0x0c1c7fff8010: 00 00 00 00 00 00 00 00 00 00 00[06]fa fa fa fa
  0x0c1c7fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==111713==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.