[Bug binutils/29289] New: display_debug_names: Assertion `name_count == buckets_filled + hash_clash_count' failed

[h3xrabbit at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29289

            Bug ID: 29289
           Summary: display_debug_names: Assertion `name_count ==
                    buckets_filled + hash_clash_count' failed
           Product: binutils
           Version: 2.39 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: h3xrabbit at gmail dot com
  Target Milestone: ---

Created attachment 14176
  --> https://sourceware.org/bugzilla/attachment.cgi?id=14176&action=edit
the file caused assertion failed

During fuzzing campaign, I found some files triggered the assertion inside
`binutils/dwarf.c:display_debug_names` with the command:
```
readelf -w file
```

Command output:
```
readelf: Warning: The e_shentsize field in the ELF header is larger than the
size of an ELF section header
readelf: Warning: Section 6 has an out of range sh_link value of 2162688
readelf: Warning: Section 7 has an out of range sh_link value of 1111638594
readelf: Warning: Section 8 has an out of range sh_link value of 14592
readelf: Warning: Section 10 has an out of range sh_link value of 237568
readelf: Warning: Section 11 has an out of range sh_link value of 4244635647
readelf: Warning: Section 12 has an out of range sh_link value of 457375744
readelf: Warning: Section 14 has an out of range sh_link value of 4278190080
readelf: Warning: The e_phentsize field in the ELF header is larger than the
size of an ELF program header
readelf: Error: Reading 728 bytes extends past end of file for program headers
section '.debug_names' has the NOBITS type - its contents are unreliable.
Contents of the .debug_names section:

readelf: Warning: Debug info is corrupted, .debug_names header at 0 has length
4c457f
readelf: Error: Reading 8192 bytes extends past end of file for .debug_names
section data
Contents of the .debug_names section:

Version 5
readelf: Warning: Padding field of .debug_names must be 0 (found 0x70)
readelf: Warning: Compilation unit count must be >= 1 in .debug_names
Augmentation string:  ("")
CU table:

TU table:

Foreign TU table:

Used 1 of 1 bucket.
Out of 0 items there are 0 bucket clashes (longest of 0 entries).
readelf: ../../binutils/dwarf.c:10239: display_debug_names: Assertion
`name_count == buckets_filled + hash_clash_count' failed.
[1]    552315 abort      ./readelf -w
```

build on latest commit (9544899f2809833729159b0acb414ef7730650d5), with default
config `../configure`

-- 
You are receiving this mail because:
You are on the CC list for the bug.