From: "da… via monorail" <monorail+v2.1355924921@chromium.org>
To: elfutils-devel@sourceware.org
Subject: Issue 45634 in oss-fuzz: elfutils:fuzz-libdwfl: Misaligned-address in file_read_elf
Date: Sun, 20 Mar 2022 02:59:30 -0700 [thread overview]
Message-ID: <0000000000009663f305daa36fec@google.com> (raw)
In-Reply-To: <0=71cc74a7ba1af446b7ed6b9a08b414d9=9ff75cc524d7cf4f3afc3bed32a44aa1=oss-fuzz@monorail-prod.appspotmail.com>
Comment #1 on issue 45634 by da...@adalogics.com: elfutils:fuzz-libdwfl: Misaligned-address in file_read_elf
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45634#c1
UBSAN report
Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-59b5bfa44a73565527249e5a6d13b3c2a9761f29
elf_begin.c:225:21: runtime error: member access within misaligned address 0x7f9d7642404c for type 'Elf64_Shdr', which requires 8 byte alignment
0x7f9d7642404c: note: pointer points here
02 01 01 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
^
#0 0x56a2ad in get_shnum /src/elfutils/libelf/elf_begin.c:225:21
#1 0x56a2ad in file_read_elf /src/elfutils/libelf/elf_begin.c:299:19
#2 0x567596 in __libelf_read_mmaped_file /src/elfutils/libelf/elf_begin.c:566:14
#3 0x56c9dd in read_file /src/elfutils/libelf/elf_begin.c:701:28
#4 0x56c678 in dup_elf /src/elfutils/libelf/elf_begin.c:1067:12
#5 0x56c678 in lock_dup_elf /src/elfutils/libelf/elf_begin.c:1119:10
#6 0x56c17e in elf_begin /src/elfutils/libelf/elf_begin.c:0
#7 0x4b5782 in process_archive /src/elfutils/libdwfl/offline.c:251:17
#8 0x4b5782 in process_file /src/elfutils/libdwfl/offline.c:125:14
#9 0x4b5e9f in __libdwfl_report_offline /src/elfutils/libdwfl/offline.c:287:22
#10 0x4b5e9f in dwfl_report_offline /src/elfutils/libdwfl/offline.c:316:10
#11 0x4b2f88 in LLVMFuzzerTestOneInput /src/fuzz-libdwfl.c:47:22
#12 0x43da32 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15
#13 0x4295e2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6
#14 0x42ee4c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9
#15 0x4577e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
#16 0x7f9d760b90b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/libc-start.c:308:16
#17 0x407d2d in _start
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior elf_begin.c:225:21 in
--
You received this message because:
1. You were specifically CC'd on the issue
You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings
Reply to this email to add a comment.
next prev parent reply other threads:[~2022-03-20 9:59 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <0=71cc74a7ba1af446b7ed6b9a08b414d9=9ff75cc524d7cf4f3afc3bed32a44aa1=oss-fuzz@monorail-prod.appspotmail.com>
2022-03-17 6:38 ` ClusterFuzz-External via monorail
2022-03-20 9:59 ` da… via monorail [this message]
2022-03-20 9:59 ` da… via monorail
2022-03-22 14:23 ` ClusterFuzz-External via monorail
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000009663f305daa36fec@google.com \
--to=monorail+v2.1355924921@chromium.org \
--cc=elfutils-devel@sourceware.org \
--cc=oss-fuzz@monorail-prod.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).