out-of-bounds read / crash in elfutils tools (readelf, nm, ...) with malformed file

Mark Wielaard mjw at redhat.com
Fri Nov 7 11:58:07 UTC 2014


On Fri, 2014-11-07 at 01:27 +0100, Hanno Böck wrote:
> Am Thu, 06 Nov 2014 16:11:43 +0100
> schrieb Mark Wielaard <mjw at redhat.com>:
> 
> > > (actually this bug report is kind of a fallout of a bug search in
> > > libbfd - various parser bugs in the binutils-tools have been found
> > > and fixed in the past days and I thought I'd run other elf-related
> > > tools on the collection of bug-exposing binaries)
> > 
> > Thanks. If you have any other examples please do report them.
> 
> Ten to crash readelf -a attached, according to american-fuzzy-lop all
> distinct code paths.

Thanks. eu-readelf didn't sanitize the hash section data before use.
The attached patch should fix that.

Cheers,

Mark
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-readelf-Sanity-check-hash-section-contents-before-pr.patch
Type: text/x-patch
Size: 4441 bytes
Desc: 
URL: <https://lists.fedorahosted.org/pipermail/elfutils-devel/attachments/20141107/180aef17/attachment.bin>


More information about the elfutils-devel mailing list