From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ed1-x52f.google.com (mail-ed1-x52f.google.com [IPv6:2a00:1450:4864:20::52f]) by sourceware.org (Postfix) with ESMTPS id 57D423846907 for ; Mon, 20 Feb 2023 10:33:51 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 57D423846907 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-ed1-x52f.google.com with SMTP id f13so2208635edz.6 for ; Mon, 20 Feb 2023 02:33:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=6ujBIRnaefhMtjw+ti4uDesVdDyLLzWyc0zxMBbiwvY=; b=N2+KevTOf6dQH6tvpuDdUDbcLKW4R3z48k2W8gFvvHuXnQZ+SbQ773BPRt+fNDZeSp V4r82eXc3IUBHGLI4VIsGgfiXyoNRrqcx+SxXUKHVnHq+Q2QIwr5V/x42UTEXeVkbYdf 7qVRzN5sPYqWABJOuoewYm+2t+ckBH0MC8Sy5FBvPk1S2hyNLiPx/3Nb1ZVLgH0tX1pl 5SEL5bofc1FANW3DZWxKaPscfXuxylxr8gXwP6gEuT+bCD3jTv9YU8TM+WW/MHcz3e17 T24TmUUKEzTTA9yVTqQd31qkrTardBJbvubVi+6PNoqBYBHuiHRz7A9m5lFjP47YvWB4 mw3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=6ujBIRnaefhMtjw+ti4uDesVdDyLLzWyc0zxMBbiwvY=; b=zmPtZcoS70TM7lMOGpJKmP+FD9H5jwUwznwD4rXo/DpRGjUf6PXfmHPbO2NJSogZsQ 1hjENM76BdzOhcw3/KEetTJ17WkMTwCau35+Qt6lNYrBO2gyIyC+jjdvP3L2KSB32tFl g64aO6nlDi9OZKCjXLT3ZZc4ADxrPr0J1E7c8e0j2kQuyhp+EBwAmFWZ7PMoSG47cO+7 LaS8UMzSc/W3kimYiAAiiwsrFpNVkwaEJA7aFGGGDkXEX6qmHWzfKtwK14pZq8QImHFY KXsVWXHEbhvxqx3KrP7+xCUqN3RG0M0fMxoagXV3Ra9NWLRZfb7NQsVxAoe/9OyDgN6H 8dgA== X-Gm-Message-State: AO0yUKX4Fg3Pj5rjEfqcxOpU2jtP64DjXBDAnb7iN97NKci94GwcNebZ 3rfr99/SOAZ4U9bQeey1Df38L5Vz6Nx9jVgQbxPEPL9H9ro= X-Google-Smtp-Source: AK7set9+as/3SGVWA9UfqlLvIfEQ1oOPgx9TK/481f7Y4bQzhR28am7E9qwufw6QaCV8Cj6ZvwYWOW9/5UBW+1dZ6c4= X-Received: by 2002:a05:6512:118d:b0:4d5:ca32:6ed6 with SMTP id g13-20020a056512118d00b004d5ca326ed6mr994234lfr.4.1676831705991; Sun, 19 Feb 2023 10:35:05 -0800 (PST) MIME-Version: 1.0 From: Evgeny Vereshchagin Date: Sun, 19 Feb 2023 21:34:52 +0300 Message-ID: Subject: MemorySanitizer: Use-of-uninitialized-value in check_section To: elfutils-devel@sourceware.org Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=0.1 required=5.0 tests=BAYES_00,DATE_IN_PAST_12_24,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: Hi, OSS-Fuzz found https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56134 introduced in fda09f5f188fb173b2123815be71ca4647a8adfb but for some reason it wasn't delivered to the mailing list. I opened https://github.com/google/oss-fuzz/issues/9755 to figure out what went wrong there but until then below is the full backtrace: ``` ==2272==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x5fb3c7 in check_section /src/elfutils/libdw/dwarf_begin_elf.c:265:7 #1 0x5f8d3e in global_read /src/elfutils/libdw/dwarf_begin_elf.c:444:14 #2 0x5f8d3e in dwarf_begin_elf /src/elfutils/libdw/dwarf_begin_elf.c:595:9 #3 0x53f28c in load_dw /src/elfutils/libdwfl/dwfl_module_getdwarf.c:1341:13 #4 0x53c5b9 in find_dw /src/elfutils/libdwfl/dwfl_module_getdwarf.c:1391:16 #5 0x53c5b9 in dwfl_module_getdwarf /src/elfutils/libdwfl/dwfl_module_getdwarf.c:1446:3 #6 0x534b72 in LLVMFuzzerTestOneInput /src/fuzz-libdwfl.c:54:3 #7 0x43dcf3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 #8 0x429452 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 #9 0x42ecfc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 #10 0x458232 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 #11 0x7fe0978dd0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/libc-start.c:308:16 #12 0x41f61d in _start Uninitialized value was created by a heap allocation #0 0x4e2310 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/msan/msan_interceptors.cpp:895:3 #1 0x6b9935 in convert_data /src/elfutils/libelf/elf_getdata.c:166:24 #2 0x6b9935 in __libelf_set_data_list_rdlock /src/elfutils/libelf/elf_getdata.c:455:7 #3 0x6ba571 in __elf_getdata_rdlock /src/elfutils/libelf/elf_getdata.c:562:5 #4 0x6ba6cd in elf_getdata /src/elfutils/libelf/elf_getdata.c:580:12 #5 0x5faec7 in check_section /src/elfutils/libdw/dwarf_begin_elf.c:246:20 #6 0x5f8d3e in global_read /src/elfutils/libdw/dwarf_begin_elf.c:444:14 #7 0x5f8d3e in dwarf_begin_elf /src/elfutils/libdw/dwarf_begin_elf.c:595:9 #8 0x53f28c in load_dw /src/elfutils/libdwfl/dwfl_module_getdwarf.c:1341:13 #9 0x53c5b9 in find_dw /src/elfutils/libdwfl/dwfl_module_getdwarf.c:1391:16 #10 0x53c5b9 in dwfl_module_getdwarf /src/elfutils/libdwfl/dwfl_module_getdwarf.c:1446:3 #11 0x534b72 in LLVMFuzzerTestOneInput /src/fuzz-libdwfl.c:54:3 #12 0x43dcf3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 #13 0x429452 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 #14 0x42ecfc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 #15 0x458232 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 #16 0x7fe0978dd0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/libc-start.c:308:16 SUMMARY: MemorySanitizer: use-of-uninitialized-value (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_elfutils_3ee01cb67db1a71e7adeb7f3f14722ea62f13cd5/revisions/fuzz-libdwfl+0x5fb3c7) ``` It can be reproduced with `readelf` and `valgrind` ``` wget -O OSS-FUZZ-56134 'https://oss-fuzz.com/download?testcase_id=6724057145147392' LD_LIBRARY_PATH="$(pwd)/libdw:$(pwd)/libelf" DEBUGINFOD_URLS= valgrind --track-origins=yes ./src/readelf -w OSS-FUZZ-56134 ==1373524== Memcheck, a memory error detector ==1373524== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al. ==1373524== Using Valgrind-3.19.0 and LibVEX; rerun with -h for copyright info ==1373524== Command: ./src/readelf -w OSS-FUZZ-56134 ==1373524== ==1373524== Conditional jump or move depends on uninitialised value(s) ==1373524== at 0x4887EAB: check_section (dwarf_begin_elf.c:265) ==1373524== by 0x48885EF: global_read (dwarf_begin_elf.c:444) ==1373524== by 0x48885EF: dwarf_begin_elf (dwarf_begin_elf.c:595) ==1373524== by 0x48A9F0C: load_dw (dwfl_module_getdwarf.c:1341) ==1373524== by 0x48AA0D0: find_dw (dwfl_module_getdwarf.c:1391) ==1373524== by 0x48AA0D0: dwfl_module_getdwarf (dwfl_module_getdwarf.c:1446) ==1373524== by 0x411109: print_debug (readelf.c:11467) ==1373524== by 0x413A31: process_elf_file (readelf.c:1062) ==1373524== by 0x4148BC: process_dwflmod (readelf.c:818) ==1373524== by 0x48A7F20: dwfl_getmodules (dwfl_getmodules.c:86) ==1373524== by 0x40954A: process_file (readelf.c:926) ==1373524== by 0x404D0E: main (readelf.c:395) ==1373524== Uninitialised value was created by a heap allocation ==1373524== at 0x484586F: malloc (vg_replace_malloc.c:381) ==1373524== by 0x48FEA25: convert_data (elf_getdata.c:166) ==1373524== by 0x48FEA25: __libelf_set_data_list_rdlock (elf_getdata.c:455) ==1373524== by 0x48FEC17: __elf_getdata_rdlock (elf_getdata.c:562) ==1373524== by 0x4887E6F: check_section (dwarf_begin_elf.c:246) ==1373524== by 0x48885EF: global_read (dwarf_begin_elf.c:444) ==1373524== by 0x48885EF: dwarf_begin_elf (dwarf_begin_elf.c:595) ==1373524== by 0x48A9F0C: load_dw (dwfl_module_getdwarf.c:1341) ==1373524== by 0x48AA0D0: find_dw (dwfl_module_getdwarf.c:1391) ==1373524== by 0x48AA0D0: dwfl_module_getdwarf (dwfl_module_getdwarf.c:1446) ==1373524== by 0x411109: print_debug (readelf.c:11467) ==1373524== by 0x413A31: process_elf_file (readelf.c:1062) ==1373524== by 0x4148BC: process_dwflmod (readelf.c:818) ==1373524== by 0x48A7F20: dwfl_getmodules (dwfl_getmodules.c:86) ==1373524== by 0x40954A: process_file (readelf.c:926) ==1373524== ./src/readelf: cannot get debug context descriptor: No DWARF information found ``` Thanks, Evgeny Vereshchagin