out-of-bounds read / crash in elfutils tools (readelf, nm, ...) with malformed file

Hanno Böck hanno at hboeck.de
Fri Nov 7 15:32:49 UTC 2014


Am Fri, 07 Nov 2014 12:58:07 +0100
schrieb Mark Wielaard <mjw at redhat.com>:

> On Fri, 2014-11-07 at 01:27 +0100, Hanno Böck wrote:
> > Am Thu, 06 Nov 2014 16:11:43 +0100
> > schrieb Mark Wielaard <mjw at redhat.com>:
> > 
> > > > (actually this bug report is kind of a fallout of a bug search
> > > > in libbfd - various parser bugs in the binutils-tools have been
> > > > found and fixed in the past days and I thought I'd run other
> > > > elf-related tools on the collection of bug-exposing binaries)
> > > 
> > > Thanks. If you have any other examples please do report them.
> > 
> > Ten to crash readelf -a attached, according to american-fuzzy-lop
> > all distinct code paths.
> 
> Thanks. eu-readelf didn't sanitize the hash section data before use.
> The attached patch should fix that.

Fixes some of them but not all.
Still crashers:
id:000053,src:000000,op:flip1,pos:879
id:000054,src:000000,op:flip1,pos:885

Also see attachmend, output from american fuzzy lop with latest git
code and your two patches. 9 crashes, 10 hangs.

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno at hboeck.de
GPG: BBB51E42
-------------- next part --------------
A non-text attachment was scrubbed...
Name: eu-readelf-crasher-hangs-2.tar.xz
Type: application/x-xz
Size: 2440 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/elfutils-devel/attachments/20141107/bfb75acd/attachment.xz>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/elfutils-devel/attachments/20141107/bfb75acd/attachment.sig>


More information about the elfutils-devel mailing list