[Bug binutils/22955] New: Heap out of bounds read in parse_stab_array_type()

[fumfi.255 at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=22955

            Bug ID: 22955
           Summary: Heap out of bounds read in parse_stab_array_type()
           Product: binutils
           Version: 2.30
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: fumfi.255 at gmail dot com
  Target Milestone: ---

Created attachment 10889
  --> https://sourceware.org/bugzilla/attachment.cgi?id=10889&action=edit
Crashing test case (objdump)

After some fuzz testing I found a crashing test case.

Version: 2.30

Command: objdump -x -D -S -s -G -g -e -t -T -r -R
objdump_hoobr_parse_stab_array_type

ASAN Context:

==2449==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000012b1d
at pc 0x000000524449 bp 0x7ffeef745850 sp 0x7ffeef745840
READ of size 1 at 0x621000012b1d thread T0
    #0 0x524448 in parse_stab_array_type
XYZ/binutils-2.30.0/binutils/stabs.c:3127
    #1 0x524448 in parse_stab_type XYZ/binutils-2.30.0/binutils/stabs.c:1577
    #2 0x5318b0 in parse_stab_string XYZ/binutils-2.30.0/binutils/stabs.c:968
    #3 0x5318b0 in parse_stab XYZ/binutils-2.30.0/binutils/stabs.c:655
    #4 0x4ebd89 in read_section_stabs_debugging_info
XYZ/binutils-2.30.0/binutils/rddbg.c:239
    #5 0x4ebd89 in read_debugging_info XYZ/binutils-2.30.0/binutils/rddbg.c:56
    #6 0x41f654 in dump_bfd objdump.c:3607
    #7 0x421a77 in display_object_bfd objdump.c:3658
    #8 0x421a77 in display_any_bfd objdump.c:3747
    #9 0x40ea81 in display_file objdump.c:3768
    #10 0x40ea81 in main objdump.c:4070
    #11 0x7f2bbf8db82f in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #12 0x411ca8 in _start (/usr/local/bin/objdump+0x411ca8)

0x621000012b1d is located 0 bytes to the right of 4637-byte region
[0x621000011900,0x621000012b1d)
allocated by thread T0 here:
    #0 0x7f2bbff21602 in malloc
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0xb57fec in xmalloc xmalloc.c:147

SUMMARY: AddressSanitizer: heap-buffer-overflow
XYZ/binutils-2.30.0/binutils/stabs.c:3127 parse_stab_array_type
Shadow bytes around the buggy address:
  0x0c427fffa510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c427fffa560: 00 00 00[05]fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa5a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c427fffa5b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==2449==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.