https://sourceware.org/bugzilla/show_bug.cgi?id=28048
Bug ID: 28048
Summary: heap-buffer-overflow on `readelf -Ww`
Product: binutils
Version: 2.37 (HEAD)
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: binutils
Assignee: unassigned at sourceware dot org
Reporter: shaohua.li at inf dot ethz.ch
Target Milestone: ---
Created attachment 13526
--> https://sourceware.org/bugzilla/attachment.cgi?id=13526&action=edit
poc
Hi there,
I crashed `readelf -Ww` with a fuzzer. There is a heap-buffer-overflow in
printf_common. (See details below)
- Compiler: clang12
- Platform: Ubuntu 18.04.5 LTS, x86_64
- Reproduce: run `readelf -Ww poc`
The AddressSanitizer report:
==111713==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60e0000000de at pc 0x000000439d78 bp 0x7ffe03ee78e0 sp 0x7ffe03ee7060
READ of size 1 at 0x60e0000000de thread T0
#0 0x439d77 in printf_common(void*, char const*, __va_list_tag*)
(/out_bin/readelf+0x439d77)
#1 0x43b0be in printf (/out_bin/readelf+0x43b0be)
#2 0x588e66 in get_type_signedness /readelf/repo/binutils/dwarf.c
#3 0x585053 in read_and_display_attr_value
/readelf/repo/binutils/dwarf.c:2970:8
#4 0x554cce in read_and_display_attr /readelf/repo/binutils/dwarf.c:3344:10
#5 0x554cce in process_debug_info /readelf/repo/binutils/dwarf.c:3956:15
#6 0x56731b in display_debug_info /readelf/repo/binutils/dwarf.c:7155:10
#7 0x4feabb in display_debug_section
/readelf/repo/binutils/readelf.c:15690:18
#8 0x4feabb in process_section_contents
/readelf/repo/binutils/readelf.c:15785:10
#9 0x4dae6f in process_object /readelf/repo/binutils/readelf.c:21514:9
#10 0x4cb6ed in process_file /readelf/repo/binutils/readelf.c:21939:13
#11 0x4cb6ed in main /readelf/repo/binutils/readelf.c:22010:11
#12 0x7f7fca356bf6 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
#13 0x41bfa9 in _start (/out_bin/readelf+0x41bfa9)
0x60e0000000de is located 0 bytes to the right of 158-byte region
[0x60e000000040,0x60e0000000de)
allocated by thread T0 here:
#0 0x496e6d in malloc (/out_bin/readelf+0x496e6d)
#1 0x6ac52a in xmalloc /readelf/repo/libiberty/./xmalloc.c:147:12
#2 0x4c9a1a in load_specific_debug_section
/readelf/repo/binutils/readelf.c:15382:8
#3 0x4fea79 in display_debug_section
/readelf/repo/binutils/readelf.c:15684:8
#4 0x4fea79 in process_section_contents
/readelf/repo/binutils/readelf.c:15785:10
#5 0x4dae6f in process_object /readelf/repo/binutils/readelf.c:21514:9
#6 0x4cb6ed in process_file /readelf/repo/binutils/readelf.c:21939:13
#7 0x4cb6ed in main /readelf/repo/binutils/readelf.c:22010:11
#8 0x7f7fca356bf6 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
SUMMARY: AddressSanitizer: heap-buffer-overflow (/out_bin/readelf+0x439d77) in
printf_common(void*, char const*, __va_list_tag*)
Shadow bytes around the buggy address:
0x0c1c7fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1c7fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
=>0x0c1c7fff8010: 00 00 00 00 00 00 00 00 00 00 00[06]fa fa fa fa
0x0c1c7fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==111713==ABORTING
--
You are receiving this mail because:
You are on the CC list for the bug.
