https://sourceware.org/bugzilla/show_bug.cgi?id=24049
Bug ID: 24049 Summary: heap-use-after-free in readelf Product: binutils Version: 2.31 Status: UNCONFIRMED Severity: normal Priority: P2 Component: binutils Assignee: unassigned at sourceware dot org Reporter: 0x0keeper at gmail dot com Target Milestone: --- Created attachment 11503 --> https://sourceware.org/bugzilla/attachment.cgi?id=11503&action=edit binutils-readelf-heap-use-after-free hi,binutils team. when i use readelf read a elf file,i get a heap-use-after-free bug reported by AddressSanitizer. # ./binutils/readelf -a binutils-readelf-heap-use-after-free File: fuzzout/crashes/id:000000,sig:06,src:000022,op:flip1,pos:2021(aaaaaaaaaaaaaaaa) readelf: Error: Not an ELF file - it has the wrong magic bytes at the start File: fuzzout/crashes/id:000000,sig:06,src:000022,op:flip1,pos:2021(gethnamaddr.o) ELF Header: Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 Class: ELF64 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: REL (Relocatable file) Machine: Advanced Micro Devices X86-64 Version: 0x1 Entry point address: 0x0 Start of program headers: 0 (bytes into file) Start of section headers: 551872 (bytes into file) .................. 694: 0000000000000016 0 SECTION <processor specific>: 15 INTERNAL [<other>: 28] UND 695: 0000000000000010 0 COMMON <processor specific>: 14 HIDDEN [<other>: 28] UND 696: 0000000000000010 0 <processor specific>: 13 <processor specific>: 14 HIDDEN [<other>: 28] UND 697: 0000137000d40012 0x6e00000000 SRELC <processor specific>: 15 HIDDEN [<other>: 28] UND 698: 000013e000d40012 0x46300000000 <OS specific>: 11 LOCAL PROTECTED [<other>: 28] UND readelf: Warning: local symbol 698 found at index >= .symtab's sh_info value of 662 699: 0000000000000010 0 <processor specific>: 13 GLOBAL PROTECTED [<other>: 28] UND 700: 0000000000000010 0 COMMON WEAK PROTECTED [<other>: 28] UND No version information found in this file. readelf: Error: ================================================================= ==12436==ERROR: AddressSanitizer: heap-use-after-free on address 0x60700000d8b0 at pc 0x000000460e16 bp 0x7fff617cbf30 sp 0x7fff617cb6e0 READ of size 2 at 0x60700000d8b0 thread T0 #0 0x460e15 (/root/binutils-2.31/binutils/readelf+0x460e15) #1 0x460712 (/root/binutils-2.31/binutils/readelf+0x460712) #2 0x46160a (/root/binutils-2.31/binutils/readelf+0x46160a) #3 0x5c4f4e (/root/binutils-2.31/binutils/readelf+0x5c4f4e) #4 0x4fc965 (/root/binutils-2.31/binutils/readelf+0x4fc965) #5 0x4ee2f6 (/root/binutils-2.31/binutils/readelf+0x4ee2f6) #6 0x7fd145e2c82f (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #7 0x419078 (/root/binutils-2.31/binutils/readelf+0x419078) 0x60700000d8b0 is located 0 bytes inside of 77-byte region [0x60700000d8b0,0x60700000d8fd) freed by thread T0 here: #0 0x4b9020 (/root/binutils-2.31/binutils/readelf+0x4b9020) #1 0x4fc709 (/root/binutils-2.31/binutils/readelf+0x4fc709) #2 0x4ee2f6 (/root/binutils-2.31/binutils/readelf+0x4ee2f6) #3 0x7fd145e2c82f (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) previously allocated by thread T0 here: #0 0x4b91a8 (/root/binutils-2.31/binutils/readelf+0x4b91a8) #1 0x5ca176 (/root/binutils-2.31/binutils/readelf+0x5ca176) SUMMARY: AddressSanitizer: heap-use-after-free (/root/binutils-2.31/binutils/readelf+0x460e15) Shadow bytes around the buggy address: 0x0c0e7fff9ac0: fa fa fd fd fd fd fd fd fd fd fd fa fa fa fa fa 0x0c0e7fff9ad0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fd fd 0x0c0e7fff9ae0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd 0x0c0e7fff9af0: fd fd fd fd fd fd fa fa fa fa fd fd fd fd fd fd 0x0c0e7fff9b00: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd =>0x0c0e7fff9b10: fd fa fa fa fa fa[fd]fd fd fd fd fd fd fd fd fd 0x0c0e7fff9b20: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fa fa 0x0c0e7fff9b30: fa fa fd fd fd fd fd fd fd fd fd fa fa fa fa fa 0x0c0e7fff9b40: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fd fd 0x0c0e7fff9b50: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd 0x0c0e7fff9b60: fd fd fd fd fd fa fa fa fa fa 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==12436==ABORTING -- You are receiving this mail because: You are on the CC list for the bug. _______________________________________________ bug-binutils mailing list bug-binutils@gnu.org https://lists.gnu.org/mailman/listinfo/bug-binutils