https://sourceware.org/bugzilla/show_bug.cgi?id=25840
Bug ID: 25840
Summary: Null pointer dereference in objdump
Product: binutils
Version: 2.35 (HEAD)
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: binutils
Assignee: unassigned at sourceware dot org
Reporter: nguyenmanhdung1710 at gmail dot com
Target Milestone: ---
Created attachment 12472
--> https://sourceware.org/bugzilla/attachment.cgi?id=12472&action=edit
PoC
Hi,
A null pointer dereference was discovered in objdump (the latest commit
8e4979a) in debug_get_real_type(), that can cause a denial of service via a
crafted file.
To reproduce: objdump -g PoC
ASAN says:
==6516==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc
0x000000462b53 bp 0x7ffc368a4570 sp 0x7ffc368a44c0 T0)
#0 0x462b52 in debug_get_real_type ../../binutils/debug.c:2038
#1 0x46bc41 in debug_class_type_samep ../../binutils/debug.c:3280
#2 0x469b12 in debug_type_samep ../../binutils/debug.c:3088
#3 0x468dac in debug_set_class_id ../../binutils/debug.c:2970
#4 0x465370 in debug_write_type ../../binutils/debug.c:2505
#5 0x465c7e in debug_write_type ../../binutils/debug.c:2554
#6 0x4658d3 in debug_write_type ../../binutils/debug.c:2536
#7 0x465c7e in debug_write_type ../../binutils/debug.c:2554
#8 0x466b3d in debug_write_type ../../binutils/debug.c:2649
#9 0x46424d in debug_write_name ../../binutils/debug.c:2378
#10 0x463feb in debug_write ../../binutils/debug.c:2350
#11 0x452a41 in print_debugging_info ../../binutils/prdbg.c:319
#12 0x4184ce in dump_bfd ../../binutils/objdump.c:4897
#13 0x418701 in display_object_bfd ../../binutils/objdump.c:4950
#14 0x418a09 in display_any_bfd ../../binutils/objdump.c:5040
#15 0x418a7e in display_file ../../binutils/objdump.c:5061
#16 0x419d4c in main ../../binutils/objdump.c:5407
#17 0x7fa59a0c182f in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#18 0x403418 in _start
(/home/dungnguyen/PoCs/binutils_f717994/objdump-asan+0x403418)
Thanks,
Manh Dung
--
You are receiving this mail because:
You are on the CC list for the bug.
