Re: out-of-bounds read / crash in elfutils tools (readelf, nm, ...) with malformed file

[-- Attachment #1: Type: text/plain, Size: 1148 bytes --]

Am Fri, 07 Nov 2014 12:58:07 +0100
schrieb Mark Wielaard <mjw@redhat.com>:

> On Fri, 2014-11-07 at 01:27 +0100, Hanno Böck wrote:
> > Am Thu, 06 Nov 2014 16:11:43 +0100
> > schrieb Mark Wielaard <mjw@redhat.com>:
> > 
> > > > (actually this bug report is kind of a fallout of a bug search
> > > > in libbfd - various parser bugs in the binutils-tools have been
> > > > found and fixed in the past days and I thought I'd run other
> > > > elf-related tools on the collection of bug-exposing binaries)
> > > 
> > > Thanks. If you have any other examples please do report them.
> > 
> > Ten to crash readelf -a attached, according to american-fuzzy-lop
> > all distinct code paths.
> 
> Thanks. eu-readelf didn't sanitize the hash section data before use.
> The attached patch should fix that.

Fixes some of them but not all.
Still crashers:
id:000053,src:000000,op:flip1,pos:879
id:000054,src:000000,op:flip1,pos:885

Also see attachmend, output from american fuzzy lop with latest git
code and your two patches. 9 crashes, 10 hangs.

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno@hboeck.de
GPG: BBB51E42

[-- Attachment #2: eu-readelf-crasher-hangs-2.tar.xz --]
[-- Type: application/x-xz, Size: 2440 bytes --]

[-- Attachment #3: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]