https://sourceware.org/bugzilla/show_bug.cgi?id=30890
Bug ID: 30890
Summary: objdump: attempting free on address which was not
malloc()-ed at bfd/elf.c:9802 in
_bfd_elf_slurp_version_tables
Product: binutils
Version: 2.42 (HEAD)
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: binutils
Assignee: unassigned at sourceware dot org
Reporter: yan.cs10 at nycu dot edu.tw
Target Milestone: ---
Created attachment 15129
--> https://sourceware.org/bugzilla/attachment.cgi?id=15129&action=edit
this poc with -T argument can crash objdump in the latest version
Summary:
A crash caused when using objdump
AddressSanitizer reported it as attempting free on address which was not
malloc()-ed
git commit, OS, Compiler and processor
git commit: be8e83130
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
g++ (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
Ubuntu 20.04.4 LTS
AMD Ryzen 5 3600X 6-Core Processor
Steps to reproduce:
$ cd binutils-gdb
$ export CFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ export CXXFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ make
$ binutils/nm-new -D ./poc_0
AddressSanitizer report:
$ /home/pt/sytseng/binutils-gdb-asan/binutils/objdump -T ./poc_0
/home/pt/sytseng/binutils-gdb-asan/binutils/objdump: option -P/--private not
supported by this file
BFD: ./pocs/poc_0: .gnu.version_r invalid entry
=================================================================
==2486577==ERROR: AddressSanitizer: attempting free on address which was not
malloc()-ed: 0x621000006688 in thread T0
#0 0x7f62bd29140f in __interceptor_free
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
#1 0x55892d993c66 in _bfd_elf_slurp_version_tables
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9802
#2 0x55892d948805 in bfd_elf64_slurp_symbol_table
/home/pt/sytseng/binutils-gdb-asan/bfd/elfcode.h:1278
#3 0x55892d99022d in _bfd_elf_canonicalize_dynamic_symtab
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9285
#4 0x55892d77be96 in slurp_dynamic_symtab objdump.c:1051
#5 0x55892d7923e0 in dump_bfd objdump.c:5656
#6 0x55892d7928cd in display_object_bfd objdump.c:5750
#7 0x55892d792c05 in display_any_bfd objdump.c:5837
#8 0x55892d792c7f in display_file objdump.c:5858
#9 0x55892d794633 in main objdump.c:6269
#10 0x7f62bcfb0082 in __libc_start_main ../csu/libc-start.c:308
#11 0x55892d77837d in _start
(/home/pt/sytseng/binutils-gdb-asan/binutils/objdump+0x13737d)
0x621000006688 is located 392 bytes inside of 4064-byte region
[0x621000006500,0x6210000074e0)
allocated by thread T0 here:
#0 0x7f62bd291808 in __interceptor_malloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x55892db79bf2 in _objalloc_alloc objalloc.c:159
#2 0x55892d8d560c in bfd_alloc
/home/pt/sytseng/binutils-gdb-asan/bfd/libbfd.c:452
#3 0x55892d95fa52 in _bfd_elf_get_dynamic_symbols
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:2293
#4 0x55892d9457a5 in bfd_elf64_object_p
/home/pt/sytseng/binutils-gdb-asan/bfd/elfcode.h:861
#5 0x55892d8d11fe in bfd_check_format_matches
/home/pt/sytseng/binutils-gdb-asan/bfd/format.c:431
#6 0x55892d7928b5 in display_object_bfd objdump.c:5748
#7 0x55892d792c05 in display_any_bfd objdump.c:5837
#8 0x55892d792c7f in display_file objdump.c:5858
#9 0x55892d794633 in main objdump.c:6269
#10 0x7f62bcfb0082 in __libc_start_main ../csu/libc-start.c:308
SUMMARY: AddressSanitizer: bad-free
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122 in
__interceptor_free
==2486577==ABORTING
--
You are receiving this mail because:
You are on the CC list for the bug.
