[Bug 277862] potential out-of-bounds in llvm-objdump in OffloadBinary::create()

2024-03-25 Thread bugzilla-noreply 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277862

--- Comment #2 from Ed Maste  ---
Upstream fix:
https://github.com/chencha3/llvm-project/commit/78b350320373176b67540465d6484ce539d1103e

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 277862] potential out-of-bounds in llvm-objdump in OffloadBinary::create()

2024-03-22 Thread bugzilla-noreply 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277862

Ed Maste  changed:

   What|Removed |Added

 CC||ema...@freebsd.org

--- Comment #1 from Ed Maste  ---
Added upstream report at https://github.com/llvm/llvm-project/issues/86280

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 277862] potential out-of-bounds in llvm-objdump in OffloadBinary::create()

2024-03-21 Thread bugzilla-noreply 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277862

Bug ID: 277862
   Summary: potential out-of-bounds in llvm-objdump in
OffloadBinary::create()
   Product: Base System
   Version: CURRENT
  Hardware: Any
OS: Any
Status: New
  Severity: Affects Some People
  Priority: ---
 Component: bin
  Assignee: b...@freebsd.org
  Reporter: r...@lcs.mit.edu

Created attachment 249370
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=249370=edit
broken ELF file that causes llvm-objdump to crash in OffloadBinary::create()

In this code in OffloadBinary::create() in
llvm-project/llvm/lib/Object/OffloadBinary.cpp:

  if (... ||
  TheHeader->EntryOffset > TheHeader->Size - sizeof(Entry) ||

if Size < sizeof(Entry), the subtraction will wrap, and a huge
EntryOffset won't be rejected. Then this array reference can generate
an out-of-bounds memory reference:

  const Entry *TheEntry =
  reinterpret_cast([TheHeader->EntryOffset]);

I've attached a demonstration:

# freebsd-version
15.0-CURRENT
# objdump --version
LLVM (http://llvm.org/):
  LLVM version 17.0.6
  Optimized build with assertions.
..
# objdump -s objdump1c.exe
PLEASE submit a bug report to https://bugs.freebsd.org/submit/ and include the
crash backtrace.
Stack dump:
0.  Program arguments: objdump -s objdump1c.exe
 #0 0x01230c41 PrintStackTrace
/usr/src/contrib/llvm-project/llvm/lib/Support/Unix/Signals.inc:602:13
 #1 0x0122f0b5 RunSignalHandlers
/usr/src/contrib/llvm-project/llvm/lib/Support/Signals.cpp:105:18
 #2 0x01231365 SignalHandler
/usr/src/contrib/llvm-project/llvm/lib/Support/Unix/Signals.inc:0:3
 #3 0x000824b055ff handle_signal /usr/src/lib/libthr/thread/thr_sig.c:0:3
 #4 0x000824b04bbb thr_sighandler
/usr/src/lib/libthr/thread/thr_sig.c:244:1
 #5 0x0008225332d3 ([vdso]+0x2d3)
 #6 0x01174709 create
/usr/src/contrib/llvm-project/llvm/lib/Object/OffloadBinary.cpp:199:29
 #7 0x00f7e328 createBinary
/usr/src/contrib/llvm-project/llvm/lib/Object/Binary.cpp:0:12
 #8 0x00f7e42a operator bool
/usr/src/contrib/llvm-project/llvm/include/llvm/Support/Error.h:559:17
 #9 0x00f7e42a createBinary
/usr/src/contrib/llvm-project/llvm/lib/Object/Binary.cpp:113:8
#10 0x00e65321 operator bool
/usr/src/contrib/llvm-project/llvm/include/llvm/Support/Error.h:559:17
#11 0x00e65321
unwrapOrError, llvm::StringRef
&> /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/llvm-objdump.h:126:7
#12 0x00e65321 dumpInput
/usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/llvm-objdump.cpp:2913:34
#13 0x00e65321
for_each, std::__1::allocator > *>, void
(*)(llvm::StringRef)>
/usr/obj/usr/src/amd64.amd64/tmp/usr/include/c++/v1/__algorithm/for_each.h:26:5
#14 0x00e65321 for_each, std::__1::allocator >,
std::__1::allocator,
std::__1::allocator > > > &, void (*)(llvm::StringRef)>
/usr/src/contrib/llvm-project/llvm/include/llvm/ADT/STLExtras.h:1731:10
#15 0x00e65321 main
/usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/llvm-objdump.cpp:3248:3
#16 0x0008281480aa __libc_start1 /usr/src/lib/libc/csu/libc_start1.c:157:2
Segmentation fault (core dumped)

-- 
You are receiving this mail because:
You are the assignee for the bug.