https://sourceware.org/bugzilla/show_bug.cgi?id=23804
Bug ID: 23804 Summary: Heap-buffer-overflow problem in function Sec_merge_hash_lookup in merge.c, as demonstrated by "ld -E" Product: binutils Version: 2.31 Status: UNCONFIRMED Severity: normal Priority: P2 Component: binutils Assignee: unassigned at sourceware dot org Reporter: wcventure at 126 dot com Target Milestone: --- Created attachment 11355 --> https://sourceware.org/bugzilla/attachment.cgi?id=11355&action=edit POC1 Heap-buffer-overflow problem in function Sec_merge_hash_lookup in merge.c, as demonstrated by "ld -E" Hi, there. A Heap-buffer-overflow problem was discovered in function Sec_merge_hash_lookup in merge.c of binutils 2.31. This problem can be reproduced in the latest code base, too. A crafted ELF input can cause segment faults and I have confirmed them with address sanitizer too. Please use the "./ld -E $POC" to reproduce the bug. The ASAN dumps the stack trace as follows: > ==6219==ERROR: AddressSanitizer: heap-buffer-overflow on address > 0x7fafe4eca898 at pc 0x0000010a46ef bp 0x7fffeb302450 sp 0x7fffeb302448 > READ of size 1 at 0x7fafe4eca898 thread T0 > #0 0x10a46ee in sec_merge_hash_lookup bintuils_gdb/bfd/merge.c:166:7 > #1 0x10a685d in sec_merge_add bintuils_gdb/bfd/merge.c:268:11 > #2 0x10996e5 in record_section bintuils_gdb/bfd/merge.c:488:12 > #3 0x10974ed in _bfd_merge_sections bintuils_gdb/bfd/merge.c:751:13 > #4 0xba24d3 in _bfd_elf_merge_sections bintuils_gdb/bfd/elflink.c:7398:5 > #5 0x589ea4 in lang_process bintuils_gdb/ld/ldlang.c:7543:7 > #6 0x5fd19c in main bintuils_gdb/ld/./ldmain.c:438:3 > #7 0x7fafe409382f in __libc_start_main > /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291 > #8 0x419638 in _start > (/media/hjwang/01D3344861A8D2E0/wcventure/Project/binutils_latest_ASAN_O0/build/bin/ld+0x419638) > > 0x7fafe4eca898 is located 0 bytes to the right of 131224-byte region > [0x7fafe4eaa800,0x7fafe4eca898) > allocated by thread T0 here: > #0 0x4b9748 in malloc > (/media/hjwang/01D3344861A8D2E0/wcventure/Project/binutils_latest_ASAN_O0/build/bin/ld+0x4b9748) > #1 0x12a243c in _objalloc_alloc bintuils_gdb/libiberty/./objalloc.c:143:22 > #2 0x83a238 in bfd_alloc bintuils_gdb/bfd/opncls.c:949:9 > #3 0x1094f3a in _bfd_add_merge_section bintuils_gdb/bfd/merge.c:432:15 > #4 0xba1cd4 in _bfd_elf_merge_sections bintuils_gdb/bfd/elflink.c:7389:12 > #5 0x589ea4 in lang_process bintuils_gdb/ld/ldlang.c:7543:7 > #6 0x5fd19c in main bintuils_gdb/ld/./ldmain.c:438:3 > #7 0x7fafe409382f in __libc_start_main > /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291 > > SUMMARY: AddressSanitizer: heap-buffer-overflow > bintuils_gdb/bfd/merge.c:166:7 in sec_merge_hash_lookup > Shadow bytes around the buggy address: > 0x0ff67c9d14c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x0ff67c9d14d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x0ff67c9d14e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x0ff67c9d14f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x0ff67c9d1500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > =>0x0ff67c9d1510: 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa > 0x0ff67c9d1520: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa > 0x0ff67c9d1530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa > 0x0ff67c9d1540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa > 0x0ff67c9d1550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa > 0x0ff67c9d1560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa > Shadow byte legend (one shadow byte represents 8 application bytes): > Addressable: 00 > Partially addressable: 01 02 03 04 05 06 07 > Heap left redzone: fa > Heap right redzone: fb > Freed heap region: fd > Stack left redzone: f1 > Stack mid redzone: f2 > Stack right redzone: f3 > Stack partial redzone: f4 > Stack after return: f5 > Stack use after scope: f8 > Global redzone: f9 > Global init order: f6 > Poisoned by user: f7 > Container overflow: fc > Array cookie: ac > Intra object redzone: bb > ASan internal: fe > Left alloca redzone: ca > Right alloca redzone: cb > ==6219==ABORTING > Aborted -- You are receiving this mail because: You are on the CC list for the bug. _______________________________________________ bug-binutils mailing list bug-binutils@gnu.org https://lists.gnu.org/mailman/listinfo/bug-binutils