https://sourceware.org/bugzilla/show_bug.cgi?id=24958
Bug ID: 24958
Summary: Buffer over read in print_insn_mmix
Product: binutils
Version: 2.33 (HEAD)
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: binutils
Assignee: unassigned at sourceware dot org
Reporter: p.antoine at catenacyber dot fr
Target Milestone: ---
Binutils is version from commit 217d2eaa69c2a5d58cdfd11619c4f2e41c986826
I have been fuzzing binutils disassembler, you can find the fuzz target here
https://github.com/google/oss-fuzz/pull/2617
Bug is buffer over read of array `spec_reg_name` of struct mmix_dis_info : `
const char *spec_reg_name[32];`
In `print_insn_mmix`, we first have
```
x = buffer[1];
y = buffer[2];
z = buffer[3];
```
Then, with no more control of these values, we use them as index for
`spec_reg_name`
For instance :
`(*info->fprintf_func) (info->stream, "%s,%d", minfop->spec_reg_name[x], z);`
There are three such lines of code
A patch could be to check `if x >= 32` and error in this case before calling
`(*info->fprintf_func)`
A reproducer can be made with :
disasm_info.arch = 0x49;
disasm_info.mach = 0;
disasm_info.flavour = 0;
disasm_info.buffer = {0xf7, 0x25, 0x00, 0x00};
disasm_info.buffer_length = 4;
--
You are receiving this mail because:
You are on the CC list for the bug.
_______________________________________________
bug-binutils mailing list
bug-binutils@gnu.org
https://lists.gnu.org/mailman/listinfo/bug-binutils
