Issue 56134 in oss-fuzz: elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section

["evv… via monorail" <monorail+v2.2672886254@chromium.org>]

[-- Attachment #1: Type: text/plain, Size: 2902 bytes --]


Comment #2 on issue 56134 by evv...@gmail.com: elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56134#c2

It can be confirmed with Valgrind:
```
wget -O OSS-FUZZ-56134 'https://oss-fuzz.com/download?testcase_id=6724057145147392'

LD_LIBRARY_PATH="$(pwd)/libdw:$(pwd)/libelf" DEBUGINFOD_URLS= valgrind --track-origins=yes ./src/readelf -w OSS-FUZZ-56134
==1373524== Memcheck, a memory error detector
==1373524== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==1373524== Using Valgrind-3.19.0 and LibVEX; rerun with -h for copyright info
==1373524== Command: ./src/readelf -w OSS-FUZZ-56134
==1373524==
==1373524== Conditional jump or move depends on uninitialised value(s)
==1373524==    at 0x4887EAB: check_section (dwarf_begin_elf.c:265)
==1373524==    by 0x48885EF: global_read (dwarf_begin_elf.c:444)
==1373524==    by 0x48885EF: dwarf_begin_elf (dwarf_begin_elf.c:595)
==1373524==    by 0x48A9F0C: load_dw (dwfl_module_getdwarf.c:1341)
==1373524==    by 0x48AA0D0: find_dw (dwfl_module_getdwarf.c:1391)
==1373524==    by 0x48AA0D0: dwfl_module_getdwarf (dwfl_module_getdwarf.c:1446)
==1373524==    by 0x411109: print_debug (readelf.c:11467)
==1373524==    by 0x413A31: process_elf_file (readelf.c:1062)
==1373524==    by 0x4148BC: process_dwflmod (readelf.c:818)
==1373524==    by 0x48A7F20: dwfl_getmodules (dwfl_getmodules.c:86)
==1373524==    by 0x40954A: process_file (readelf.c:926)
==1373524==    by 0x404D0E: main (readelf.c:395)
==1373524==  Uninitialised value was created by a heap allocation
==1373524==    at 0x484586F: malloc (vg_replace_malloc.c:381)
==1373524==    by 0x48FEA25: convert_data (elf_getdata.c:166)
==1373524==    by 0x48FEA25: __libelf_set_data_list_rdlock (elf_getdata.c:455)
==1373524==    by 0x48FEC17: __elf_getdata_rdlock (elf_getdata.c:562)
==1373524==    by 0x4887E6F: check_section (dwarf_begin_elf.c:246)
==1373524==    by 0x48885EF: global_read (dwarf_begin_elf.c:444)
==1373524==    by 0x48885EF: dwarf_begin_elf (dwarf_begin_elf.c:595)
==1373524==    by 0x48A9F0C: load_dw (dwfl_module_getdwarf.c:1341)
==1373524==    by 0x48AA0D0: find_dw (dwfl_module_getdwarf.c:1391)
==1373524==    by 0x48AA0D0: dwfl_module_getdwarf (dwfl_module_getdwarf.c:1446)
==1373524==    by 0x411109: print_debug (readelf.c:11467)
==1373524==    by 0x413A31: process_elf_file (readelf.c:1062)
==1373524==    by 0x4148BC: process_dwflmod (readelf.c:818)
==1373524==    by 0x48A7F20: dwfl_getmodules (dwfl_getmodules.c:86)
==1373524==    by 0x40954A: process_file (readelf.c:926)
==1373524==
./src/readelf: cannot get debug context descriptor: No DWARF information found
```

-- 
You received this message because:
  1. You were specifically CC'd on the issue

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings

Reply to this email to add a comment.