[Bug binutils/32399] New: A heap buffer overflow is found in display_bfd of binutils 2.44 (HEAD) in size.c:354

[xiezhiheng at huawei dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=32399

            Bug ID: 32399
           Summary: A heap buffer overflow is found in display_bfd of
                    binutils 2.44 (HEAD) in size.c:354
           Product: binutils
           Version: 2.44 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: xiezhiheng at huawei dot com
  Target Milestone: ---

Created attachment 15808
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15808&action=edit
size poc file

Hi,

There is a heap buffer overflow bug in binutils 2.44 (HEAD).

To reproduce this bug, use:

1. compile binutils with gcc 7.3.0 and address sanitizer:

```
../configure --disable-gdb --disable-gdbserver --disable-gdbsupport
--disable-libdecnumber --disable-readline --disable-sim --disable-libbacktrace
--disable-gas --disable-ld --disable-werror --enable-targets=all
CPPFLAGS="-DDEBUG" CFLAGS="-g -O0 -fsanitize=address"
make
```

2. use `size` to process the `poc` file (see attachment):

```
./size ./poc
```

   text    data     bss     dec     hex filename
=================================================================
==45528==ERROR: AddressSanitizer: heap-buffer-overflow on address
0xffff9c2006f4 at pc 0xffff9fb15c1c bp 0xfffff0f06080 sp 0xfffff0f06130
READ of size 5 at 0xffff9c2006f4 thread T0
    #0 0xffff9fb15c1b  (/usr/lib64/libasan.so.4+0x44c1b)
    #1 0xffff9fb15ef7 in __interceptor_vprintf
(/usr/lib64/libasan.so.4+0x44ef7)
    #2 0xffff9fb16007 in printf (/usr/lib64/libasan.so.4+0x45007)
    #3 0x40474b in display_bfd ../../binutils/size.c:354
    #4 0x40498f in display_file ../../binutils/size.c:429
    #5 0x404037 in main ../../binutils/size.c:259
    #6 0xffff9f93abeb in __libc_start_main (/usr/lib64/libc.so.6+0x20beb)
    #7 0x4033a3  (size+0x4033a3)

0xffff9c2006f4 is located 0 bytes to the right of 4-byte region
[0xffff9c2006f0,0xffff9c2006f4)
allocated by thread T0 here:
    #0 0xffff9fba41db in __interceptor_malloc (/usr/lib64/libasan.so.4+0xd31db)
    #1 0x42a483 in bfd_malloc ../../bfd/libbfd.c:291
    #2 0x10c256b in bfd_mach_o_core_fetch_environment ../../bfd/mach-o.c:5990
    #3 0x10c2867 in bfd_mach_o_core_file_failing_command
../../bfd/mach-o.c:6021
    #4 0x422b87 in bfd_core_file_failing_command ../../bfd/corefile.c:58
    #5 0x40472b in display_bfd ../../binutils/size.c:352
    #6 0x40498f in display_file ../../binutils/size.c:429
    #7 0x404037 in main ../../binutils/size.c:259
    #8 0xffff9f93abeb in __libc_start_main (/usr/lib64/libc.so.6+0x20beb)
    #9 0x4033a3  (size+0x4033a3)

SUMMARY: AddressSanitizer: heap-buffer-overflow
(/usr/lib64/libasan.so.4+0x44c1b)
Shadow bytes around the buggy address:
  0x200ff3840080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x200ff3840090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x200ff38400a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x200ff38400b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x200ff38400c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x200ff38400d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[04]fa
  0x200ff38400e0: fa fa fd fd fa fa 00 01 fa fa 00 04 fa fa 00 04
  0x200ff38400f0: fa fa 00 04 fa fa fd fa fa fa fa fa fa fa fa fa
  0x200ff3840100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x200ff3840110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x200ff3840120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==45528==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.