Replying to this email means your email address will be shared with the
team that works on this product.
https://issues.oss-fuzz.com/issues/505028216

Reference Info: 505028216 binutils:fuzz_addr2line: Crash in
z80_elf_16_be_reloc
component:  Public Trackers > 1362134 > OSS Fuzz
status:  New
reporter:  [email protected]
cc:  [email protected], [email protected], [email protected], and 2 more
collaborators:  [email protected]
type:  Vulnerability
access level:  Limited visibility
priority:  P2
severity:  S1
hotlist:  Reproducible, Stability-LibFuzzer,
Stability-Memory-AddressSanitizer
retention:  Component default
Project:  binutils
Reported:  Apr 21, 2026

[email protected] added comment #1:
Detailed Report: https://oss-fuzz.com/testcase?key=5072538802913280

Project: binutils
Fuzzing Engine: honggfuzz
Fuzz Target: fuzz_addr2line
Job Type: honggfuzz_asan_binutils
Platform Id: linux

Crash Type: UNKNOWN WRITE
Crash Address: 0x790bb5db14cd
Crash State:
  z80_elf_16_be_reloc
  bfd_perform_relocation
  bfd_generic_get_relocated_section_contents

Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed:
https://oss-fuzz.com/revisions?job=honggfuzz_asan_binutils&range=202410160602:202410180646

Reproducer Testcase:
https://oss-fuzz.com/download?testcase_id=5072538802913280

Issue filed automatically.

See https://google.github.io/oss-fuzz/advanced-topics/reproducing for
instructions to reproduce this bug locally.
When you fix this bug, please
  * mention the fix revision(s).
  * state whether the bug was a short-lived regression or an old bug in any
stable releases.
  * add any other useful information.
This information can help downstream consumers.

If you need to contact the OSS-Fuzz team with a question, concern, or any
other feedback, please file an issue at
https://github.com/google/oss-fuzz/issues. Comments on individual Monorail
issues are not monitored.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without an upstream patch, then the bug report will automatically
become visible to the public.


Generated by Google IssueTracker notification system.

Reply via email to