Hi,
I recently discovered a heap-buffer-overflow vulnerability when fuzzing nm-new.
Here are some details:
compile:
export CC=gcc
export CXX=g++
export CFLAGS="-g -fsanitize=address,undefined"
export CXXFLAGS="-g -fsanitize=address,undefined"
./configure --disable-libdecnumber --disa
https://sourceware.org/bugzilla/show_bug.cgi?id=24600
Maciej W. Rozycki changed:
What|Removed |Added
Severity|normal |enhancement
CC|
https://sourceware.org/bugzilla/show_bug.cgi?id=32816
--- Comment #3 from H.J. Lu ---
(In reply to Aliaksey Kandratsenka from comment #2)
> As noted above, I have tried --no-as-needed. And yes it kinda "works", but
> it is not great.
>
> There several imperfections with --no-as-needed:
>
> *)
https://sourceware.org/bugzilla/show_bug.cgi?id=32732
--- Comment #9 from Jan Beulich ---
Before marking this resolved, I wonder if the change should be cherry-picked
onto the 2.44 branch (there's likely little point in also putting it on the
2.43 one). Nick?
--
You are receiving this mail beca
https://sourceware.org/bugzilla/show_bug.cgi?id=32816
Sam James changed:
What|Removed |Added
CC||sam at gentoo dot org
--
You are receivi
https://sourceware.org/bugzilla/show_bug.cgi?id=32813
--- Comment #7 from H.J. Lu ---
(In reply to Andreas Abel from comment #5)
> If it is not a bug, but a conscious choice to prefer the form without the
> REX prefix to optimize the instruction size, I would expect that
> `{nooptimize} LSL RCX,
https://sourceware.org/bugzilla/show_bug.cgi?id=32816
--- Comment #2 from Aliaksey Kandratsenka ---
As noted above, I have tried --no-as-needed. And yes it kinda "works", but it
is not great.
There several imperfections with --no-as-needed:
*) automake stuff insists on having only -lfoobar (and
https://sourceware.org/bugzilla/show_bug.cgi?id=32732
--- Comment #8 from Sourceware Commits ---
The master branch has been updated by Jan Beulich :
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=43ea7d00a76eb3a8e30aa91657e535f86e8658c4
commit 43ea7d00a76eb3a8e30aa91657e535f86e8658c
Replying to this email means your email address will be shared with the
team that works on this product.
https://issues.oss-fuzz.com/issues/408254000
Reference Info: 408254000 binutils:fuzz_addr2line: Heap-buffer-overflow in
bfd_getb16
component: Public Trackers > 1362134 > OSS Fuzz
status: New
