From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: multipart/mixed; boundary="===============3001945267102657771==" MIME-Version: 1.0 From: =?utf-8?q?Hanno_B=C3=B6ck_=3Channo_at_hboeck=2Ede=3E?= To: elfutils-devel@lists.fedorahosted.org Subject: Re: out-of-bounds read / crash in elfutils tools (readelf, nm, ...) with malformed file Date: Sat, 08 Nov 2014 17:10:39 +0100 Message-ID: <20141108171039.4720f903@pc> In-Reply-To: 20141108140416.GB28913@blokker.redhat.com --===============3001945267102657771== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Am Sat, 8 Nov 2014 15:04:16 +0100 schrieb Mark Wielaard : > I have pushed all three fuzz-robustify patches to master. Yeah, seems robustness improved a lot. I couldn't trivially find another crasher in readelf on git head, however here are three more in nm. Seems they only crash on 32 bit. cu, -- = Hanno B=C3=B6ck http://hboeck.de/ mail/jabber: hanno@hboeck.de GPG: BBB51E42 --===============3001945267102657771== Content-Type: application/x-xz MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="elfutils-nm-crasher.tar.xz" /Td6WFoAAATm1rRGAgAhARYAAAB0L+Wj4Hf/B6ZdADSZA0E8ZbBmA3D36B1uok3et27FLHyD2QOI /UmuUqhta7wv3PJ/odwOjmvHzd6BwFyLzMWpt+KH4cbk0Q7aE21O4uNxF1dCeTSWN41O1X4nf7Lr vEXKfulxKfJES1CM5VkcIS+QtMhgaVtm+u80t+pIM7gWOzMikVMUZmAt8pXqZGwHPs9Nwn+1UPmL ApdZ/tUfOqOJqoinh/VcAFBwbffW6w4hS6yqo+8pPB8ytjaYL+WBi/sAE18mf6/ymEcl2wCmMDOM +E9SDv5jO+XmUxABhdEMRCiREOQfwmvGz41HHGQ33MuprQnpTX4n85dbo6xVMdns6wfFzoIPonyw cQiqug1WSgV4IvhyD9GlgRZVKgMuJ8RqXmho72B7a18jFYtj2AnBsIBnyYrXThHO4t9uP5eguXTn VT+ViHt6eeyFmvae52eQPSQB9iRLZSUonDvnsszNjYWRdxBPsUJRbZij2OJL1EYe58eMX8GtRiYq LlLTuQ1v1FV2RWwBKSI9KLRq5WZLeUSEmVetNJo9Kjr18bG1FCdGfI++oVqk2FKdZrKPNlJ1Ko9x zPmtzPUKTt3+eRrKeYfI9354uhINtJrZFUFMu/W3ni9iPyt5Xfgda8jEJqmQdQ6sQFKC7mZx30WZ GiUcdipvTk52e/j+61kGT0ZPsiXJ0sXbbiAQCuhlC63srkYAwwPNBE6sjAW3GKx6VWHa9V2Pz/0w RIdz1tg5ItOkAwFIbR5NnoB3DgD2PAADkBTXKTXRN69tm2xhMeDS22kTerIeqcCi1d5r3rXZPecH tuygex6S5QOYfxLNpPSK9IwLcpYP/y4oCwhpq0lYe5a6nyGe+uorTcDTYRLLgtsyY5bEWicruF3J V6aTlTHbxDgkJj2R/seIISKxIrCmm/ULxRujIP60GMw+N80Tm4CUovy6wPD19rld3vFwB/dh0TXA MJH4Tt9WjK3rwvEknJBZ4RFEZfPeCSLXps65oYfH7BQCNS4twhkJVdw+Vs3X0O0YykxTWtF/1Ne3 GWpbzHRiUGkc4p0ziAO5KD0RQa647kmdZxpWHsUm+QqzRmc7TNlEq6Mv8nr6yII3rmVJ8aYdYuSy qGe7cO7DZWejjlt4j2y5catnR0WiJSVO2DB1+iVT68ENaWm3qHbugzfgOf4X3tr51jD4lF8gXPNe d5gIWQkcqu2JeFC7RJAUz+gU3fFlfQ410JT+6ywW1X8U8dV5Yi4PkZ9Kkz3cPetRjcHJSH8dDMXr z2gCgSY4EPkN7O/EAiimTc9g67wc9nCNdNTCuVnRBWnD6JvRiwVDDQKKZpeDydzKfYL2ltTwpMu3 w8eqkJnIHABuWpNxeOLr0fykZBKCr5HKX3ZJJU+OANlBWuy+/LaCjrkCFPyw/zlwv8366PGeuxGA gsUgIyB6WpTBsM3v7fGP06+3H0y2CIxZaC/v6pSb5uCSCtwYjlvkdqxWUJFibH5lfgEXvKBU+mvY 9qt4fzmb3fWGn4ZX61q+6+18nfuOsXaYTzwgi+jLtWKpWBhjY8LjzTIvP0uqVKyD9qLiTq/h0QEg sWDamaaxsvypCAE1VmKGakr1mUarYMXYvZpVrmmwfdP3WOr3sJlByEEv0LmRC1cgTwPK+YfA4r5a q9juIwQRnUwuGkHcdTYF5f3zCIqhzGnEov7W4rtucUdB1bZVJLv6MLgaV8MllZTGwSBkG6IrNd9N vzDy4Uk9HKpJnbcYoXTvbxG6a80jNqSm62t2T50YpxK4a+Q0HSfEbk0Lv/S9+iBEJ8PlE9ihkL4l BKZ539fZEQgfdqzfWkUcim4X4yCDQW7zNvm0HK94lIinW1xvUwPsm85ktgC3mUn7/7fyfDbeluS3 v+LGGSD6JDwXeboXdnxCHSzPrkzLNWsMZonIdLrzBCv1toeq1bNB3K4tHzq6YmT9w2GNUeQoc0tD U6d1sMYldTNEAgmoCFdZ2xuHGYMZlvXqr+yU574AkfjfZnLPJ5kqZm+mLlqxxyFodisZjrthVcR6 9KRF+VUrZTexgMWZuOBNsPVOjmsxj+yZqeTha4zropIYd3wMhhSCF+S56nIk7TEEIKDgE3oeSwwh 2XLFLppQqjujVYBtJMjAPnyGOBkTv4goHY7PcBaaahyaajzNrFZKzWLVRhODSVh6UajmZdZe/EqG WP/q17SJH/GU7zWRWdK/RKlqNy4nY8zzto2yz21I+e1vEE5YUlYIlf7EqsKkGu1hwDMSDaP9BS5i I1w8hCGRZ9bCFw16Y2So9ZhLbKUzzrMdpIiFpin6quuASvz0zJ5d2QAhrlPQ5Kqi1jSc3ymJRg8b g3QcrfQkkokp3UKMqcWMZtRHn0NcS2HUofDJsloUYvl2Rs1uYB0hZ4hLg7eoY66O462KJKbG1mhl K5zhbeRnHlvF/NRkwdrBTj5DTWDIv1UMgDv7+B6pvcPmUEeArHr9vmBwCuiIWsjyww/r27kiKYGC b+Dapwx299A7d3QW0bw/rC5y4y26vYQYerbnuyaZWA83nmF0xcz/l+PHxZHt1aKl1We4VllWaArr sd90qIZEliNfn1fhO5jHpCOOMV0qo/zVWvC0+VaNNzHEIinpV1s1bW1wnEJkn+m3oo8vAAAAjW7n BCgHO6gAAcIPgPABABkIo1yxxGf7AgAAAAAEWVo= --===============3001945267102657771== Content-Type: application/pgp-signature MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="signature.asc" LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbjogR251UEcgdjIKCmlRSWNCQUVC Q2dBR0JRSlVYa0IvQUFvSkVLV0lBSEs3dFI1QzZib1AvMk1xL0xoT1NlMW1IdGIrbmdXRVA4Z20K N1gzb2VuM2NjVE5UVEk0ZTR3c3NvYy9nbXRKeGNXcXN2ajhXNGJDeHV6VGFJNS9KOUJFNVNCelZN Z3lueGhkegpYQWdvWVFTZWxPRWxlKzNwWUJQWTZuRWhNclBPWWhBQ3pVaTY4STlMSWRodGxGVDAz R1o5eEJsUmJYcEpZeEZpClB3aVczenNsV0lEanRmK2JGL3luMTNtMHlqR2ZEZUwrSEpZRkNnNFRa Q1J1bUxDZWJlVWlDQWlaRnhFNXhpOFgKVldCYW5mb1ZPdFdHbnBidFdXaEtpZG4yM1lQRkRTR1N4 ZUtOdkoyek93amJ5Y0lKUWxsWGRMcVVraTh3NDV5UQpZZVNnQVJjQnh0dE16R21zSTVDQVFXQllH eDdTSWxxclNSKzFQWCtMbUlOc3g4ZDYvUFJ5SnIzZFRNbDZwbU13CnpuTXFITDFYM2V0WVp6ZmV0 Y09qcTYwNEdnNFptUm5VeFlFVjRWbWkwWHJoRGI1K3JaWGdJbitUS3l5NW5BclMKMlJ3TS9TRWZn T0pqZjVudjYrVTM1S0lFYldTUXlSdmhoaGp0M2tCYU1MWUhnZHpyUVpPVHNxczVXZkJxWFAyWgpl OGNWQ0svRmpkeEk1WUZIUzViQ2tRS3Ruc2tYNXAzM1BsQ1BCL0NCM09ZVUVmVjNPdFpwMU82dTll ZUNGQVFWCit0OEhmQkliL0V0M0FuT0ZXVnE0UjJkZlVJaDc3UkcxU015OWxINmZpSUF6V2VIQW1J SUFHL0xXTStLYWUvOFkKN3IwSTZ3anRGb21DWlJzdkNjengrRUg4U2E1WHR6TFFCdTlOSzhmdFBH UkF5blFsaUhja2k1UkJlSFc0eVZVNwo0d2dNeW1tY3BpZDhCbVRMOGp2bgo9R1liVgotLS0tLUVO RCBQR1AgU0lHTkFUVVJFLS0tLS0K --===============3001945267102657771==--