[Bug binutils/31457] New: strip: SEGV in copy_archive

[chkunq at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=31457

            Bug ID: 31457
           Summary: strip: SEGV in copy_archive
           Product: binutils
           Version: 2.43 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: chkunq at gmail dot com
  Target Milestone: ---

Created attachment 15389
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15389&action=edit
A zip archive containing the input files to trigger the bug

Dear All,

This bug was found on Ubuntu 20.04 64-bit & binutils was checked out from main
repository at git://sourceware.org/git/binutils-gdb.git. Its commit is
5b95198e2e40b0301d37d989edc344a334c26b12 (Thu, 7 Mar 2024 00:00:53).

binutils was built with ASAN using clang-14. The configure command was:

CC=clang CFLAGS="-DFORTIFY_SOURCE -fstack-protector-all -fsanitize=address
-fno-omit-frame-pointer -g -Wno-error" ../configure --disable-shared
--disable-gdb --disable-libdecnumber --disable-readline --disable-sim

To reproduce:
Download and unzip the attached zip archive, and get POCs
strip-new --strip-all -o /dev/null [poc_file]

ASAN says:
==2468890==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000f0 (pc
0x0000003e5972 bp 0x7ffd4c9d0d20 sp 0x7ffd4c9d09e0 T0)
==2468890==The signal is caused by a WRITE memory access.
==2468890==Hint: address points to the zero page.
    #0 0x3e5972 in copy_archive
/data/symccgo/bug/binutils/obj-asan/binutils/../../binutils-gdb/binutils/objcopy.c:3798:8
    #1 0x3e5972 in copy_file
/data/symccgo/bug/binutils/obj-asan/binutils/../../binutils-gdb/binutils/objcopy.c:3956:7
    #2 0x3e2513 in strip_main
/data/symccgo/bug/binutils/obj-asan/binutils/../../binutils-gdb/binutils/objcopy.c:4973:7
    #3 0x3e2513 in main
/data/symccgo/bug/binutils/obj-asan/binutils/../../binutils-gdb/binutils/objcopy.c:6173:5
    #4 0x7f32cec7f082 in __libc_start_main
/build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #5 0x31eeed in _start
(/data/symccgo/bug/binutils/obj-asan/binutils/strip-new+0x31eeed)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
/data/symccgo/bug/binutils/obj-asan/binutils/../../binutils-gdb/binutils/objcopy.c:3798:8
in copy_archive
==2468890==ABORTING


It's worth mentioning that this bug cannot be stably reproduced 100% in one
attempt; it might require multiple attempts to replicate.

-- 
You are receiving this mail because:
You are on the CC list for the bug.