[Bug general/24385] New: Regression lead to Invalid Address Deference, in handle_elf function in /src/strip.c
https://sourceware.org/bugzilla/show_bug.cgi?id=24385 Bug ID: 24385 Summary: Regression lead to Invalid Address Deference, in handle_elf function in /src/strip.c Product: elfutils Version: unspecified Status: UNCONFIRMED Severity: normal Priority: P2 Component: general Assignee: unassigned at sourceware dot org Reporter: wcventure at 126 dot com CC: elfutils-devel at sourceware dot org Target Milestone: --- Created attachment 11698 --> https://sourceware.org/bugzilla/attachment.cgi?id=11698&action=edit POC1 Hi, I found some a regression bug. This is anInvalid Address Deference bug, in handle_elf function in /src/strip.c. This problem exists in elfutils-0.176, but cannot reproduce in elfutils-0.175. Thus this is a regression bug. elfutils 0.175 is right. Here are the POC files. Please use " ./eu-strip $POC " to reproduce this ASAN bt: > ASAN:SIGSEGV > = > ==10044==ERROR: AddressSanitizer: SEGV on unknown address 0x7ffce19d97b0 (pc > 0x0041339d bp 0x7ffce1978410 sp 0x7ffce1976750 T0) > #0 0x41339c in handle_elf elfutils-0.176/src/strip.c:1978 > #1 0x41a2d1 in process_file elfutils-0.176/src/strip.c:769 > #2 0x403b4b in main elfutils-0.176/src/strip.c:272 > #3 0x7f505ec0382f in __libc_start_main > (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) > #4 0x4046d8 in _start (elfutils-0.176_ASAN/build/bin/eu-strip+0x4046d8) > > AddressSanitizer can not provide additional info. > SUMMARY: AddressSanitizer: SEGV elfutils-0.176/src/strip.c:1978 handle_elf > ==10044==ABORTING -- You are receiving this mail because: You are on the CC list for the bug.
[Bug general/24385] Regression lead to Invalid Address Deference, in handle_elf function in /src/strip.c
https://sourceware.org/bugzilla/show_bug.cgi?id=24385 --- Comment #1 from wcventure --- Created attachment 11699 --> https://sourceware.org/bugzilla/attachment.cgi?id=11699&action=edit POC2 -- You are receiving this mail because: You are on the CC list for the bug.
[Bug libelf/24387] New: Invalid address Deference in elf32_xlatetom function in libelf/elf32_xlatetom.c
https://sourceware.org/bugzilla/show_bug.cgi?id=24387 Bug ID: 24387 Summary: Invalid address Deference in elf32_xlatetom function in libelf/elf32_xlatetom.c Product: elfutils Version: unspecified Status: UNCONFIRMED Severity: normal Priority: P2 Component: libelf Assignee: unassigned at sourceware dot org Reporter: wcventure at 126 dot com CC: elfutils-devel at sourceware dot org Target Milestone: --- Created attachment 11701 --> https://sourceware.org/bugzilla/attachment.cgi?id=11701&action=edit POC1 Similar to Bug 24103. But this bug happened in elf32_xlatetom function, and can still reproduce on elfutils 0.176. So the Fixed is Incomplete. Need to check the root cause. Here are the POC file. Please use the "eu-stack --core=$POC"to reproduce the bug. ASAN backtrace: > = > ==6345==ERROR: AddressSanitizer: unknown-crash on address 0x7f79e8976000 at > pc 0x7f79e7886df8 bp 0x7ffd4529cf30 sp 0x7ffd4529c6d8 > READ of size 3104 at 0x7f79e8976000 thread T0 > #0 0x7f79e7886df7 in __asan_memmove > (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8cdf7) > #1 0x7f79e756ac2b in memmove > /usr/include/x86_64-linux-gnu/bits/string3.h:59 > #2 0x7f79e756ac2b in elf32_xlatetom > /Regression/elfutils-0.176/libelf/elf32_xlatetom.c:100 > #3 0x7f79e72c29c8 in dwfl_segment_report_module > /Regression/elfutils-0.176/libdwfl/dwfl_segment_report_module.c:607 > #4 0x7f79e72d51b9 in dwfl_core_file_report > /Regression/elfutils-0.176/libdwfl/core-file.c:543 > #5 0x40322d in parse_opt /Regression/elfutils-0.176/src/stack.c:590 > #6 0x7f79e6b2a847 in argp_parse (/lib/x86_64-linux-gnu/libc.so.6+0x114847) > #7 0x40271b in main /Regression/elfutils-0.176/src/stack.c:690 > #8 0x7f79e6a3682f in __libc_start_main > (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) > #9 0x402ef8 in _start > (/Regression/elfutils-0.176_ASAN/build/bin/eu-stack+0x402ef8) > > AddressSanitizer can not describe address in more detail (wild memory access > suspected). > SUMMARY: AddressSanitizer: unknown-crash ??:0 __asan_memmove > Shadow bytes around the buggy address: > 0x0fefbd126bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x0fefbd126bc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x0fefbd126bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x0fefbd126be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x0fefbd126bf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > =>0x0fefbd126c00:[fe]fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe > 0x0fefbd126c10: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe > 0x0fefbd126c20: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe > 0x0fefbd126c30: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe > 0x0fefbd126c40: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe > 0x0fefbd126c50: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe > Shadow byte legend (one shadow byte represents 8 application bytes): > Addressable: 00 > Partially addressable: 01 02 03 04 05 06 07 > Heap left redzone: fa > Heap right redzone: fb > Freed heap region: fd > Stack left redzone: f1 > Stack mid redzone: f2 > Stack right redzone: f3 > Stack partial redzone: f4 > Stack after return: f5 > Stack use after scope: f8 > Global redzone: f9 > Global init order: f6 > Poisoned by user:f7 > Container overflow: fc > Array cookie:ac > Intra object redzone:bb > ASan internal: fe > ==6345==ABORTING -- You are receiving this mail because: You are on the CC list for the bug.
[Bug libelf/24387] Invalid address Deference in elf32_xlatetom function in libelf/elf32_xlatetom.c
https://sourceware.org/bugzilla/show_bug.cgi?id=24387 --- Comment #1 from wcventure --- Created attachment 11702 --> https://sourceware.org/bugzilla/attachment.cgi?id=11702&action=edit POC2 -- You are receiving this mail because: You are on the CC list for the bug.
