[Bug binutils/22893] New: heap buffer overflow in bfd_getl32

[luanjunchao at 163 dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=22893

            Bug ID: 22893
           Summary: heap buffer overflow in  bfd_getl32
           Product: binutils
           Version: 2.31 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: luanjunchao at 163 dot com
  Target Milestone: ---

The command I test is "nm-new -A -a -l -S -s --special-syms --synthetic
--with-symbol-versions -D $POC".
Here is the output.                                
=================================================================  
==93407==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf2ee250a at
pc 0x080a1f18 bp 0xffa2dbf8 sp 0xffa2dbe8              
READ of size 4 at 0xf2ee250a thread T0                             
    #0 0x80a1f17 in bfd_getl32 /work/binutils-gdb/bfd/libbfd.c:638 
    #1 0x83257b4 in read_4_bytes /work/binutils-gdb/bfd/dwarf2.c:614            
    #2 0x83257b4 in read_attribute_value /work/binutils-gdb/bfd/dwarf2.c:1228   
    #3 0x83257b4 in read_attribute /work/binutils-gdb/bfd/dwarf2.c:1280         
    #4 0x83257b4 in scan_unit_for_symbols /work/binutils-gdb/bfd/dwarf2.c:3143  
    #5 0x8332bef in comp_unit_maybe_decode_line_info
/work/binutils-gdb/bfd/dwarf2.c:3656                                            
    #6 0x8332bef in comp_unit_find_line /work/binutils-gdb/bfd/dwarf2.c:3682    
    #7 0x833fd0d in _bfd_dwarf2_find_nearest_line
/work/binutils-gdb/bfd/dwarf2.c:4640                                            
    #8 0x8200b52 in _bfd_elf_find_line /work/binutils-gdb/bfd/elf.c:8782        
    #9 0x80544f6 in print_symbol /work/binutils-gdb/binutils/nm.c:1008          
    #10 0x80572aa in print_symbols /work/binutils-gdb/binutils/nm.c:1089        
    #11 0x80572aa in display_rel_file /work/binutils-gdb/binutils/nm.c:1205     
    #12 0x805a927 in display_file /work/binutils-gdb/binutils/nm.c:1325         
    #13 0x804f5e6 in main /work/binutils-gdb/binutils/nm.c:1799                 
    #14 0xf6fe6636 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18636) 
    #15 0x805135b  (/work/build/binutils/nm-new+0x805135b)                      

AddressSanitizer can not describe address in more detail (wild memory access
suspected).                                               
SUMMARY: AddressSanitizer: heap-buffer-overflow
/work/binutils-gdb/bfd/libbfd.c:638 bfd_getl32                                  
Shadow bytes around the buggy address:                                          
  0x3e5dc450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa      
  0x3e5dc460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa                   
  0x3e5dc470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa      
  0x3e5dc480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa      
  0x3e5dc490: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa                   
=>0x3e5dc4a0: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa                   
  0x3e5dc4b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa                   
  0x3e5dc4c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa                   
  0x3e5dc4d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa    
  0x3e5dc4e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa                   
  0x3e5dc4f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa                   
Shadow byte legend (one shadow byte represents 8 application bytes):            
  Addressable:           00                                                     
  Partially addressable: 01 02 03 04 05 06 07                                   
  Heap left redzone:       fa                                                   
  Heap right redzone:      fb                                                   
  Freed heap region:       fd                                                   
  Stack left redzone:      f1                                                   
  Stack mid redzone:       f2                                                   
  Stack right redzone:     f3                                                   
  Stack partial redzone:   f4                                                   
  Stack after return:      f5                                                   
  Stack use after scope:   f8                                                   
  Global redzone:          f9                                      
  Global init order:       f6                                                   
  Poisoned by user:        f7                                      
  Container overflow:      fc                                      
  Array cookie:            ac                                                   
  Intra object redzone:    bb                                                   
  ASan internal:           fe                                                   
==93407==ABORTING              

The POC file is
https://github.com/skysider/FuzzVuln/blob/master/binutils_nm_heap_overflow_bfd_get_32.elf

-- 
You are receiving this mail because:
You are on the CC list for the bug.