From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 52766 invoked by alias); 17 Aug 2018 04:11:24 -0000 Mailing-List: contact elfutils-devel-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Post: List-Help: List-Subscribe: Sender: elfutils-devel-owner@sourceware.org Received: (qmail 52563 invoked by uid 48); 17 Aug 2018 04:11:11 -0000 From: "wcventure at 126 dot com" To: elfutils-devel@sourceware.org Subject: [Bug general/23542] New: heap-buffer-overflow in /elfutils/src/elflint.c:2055 check_sysv_hash Date: Fri, 17 Aug 2018 04:11:00 -0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: elfutils X-Bugzilla-Component: general X-Bugzilla-Version: unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: wcventure at 126 dot com X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at sourceware dot org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter cc target_milestone attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-SW-Source: 2018-q3/txt/msg00069.txt.bz2 https://sourceware.org/bugzilla/show_bug.cgi?id=3D23542 Bug ID: 23542 Summary: heap-buffer-overflow in /elfutils/src/elflint.c:2055 check_sysv_hash Product: elfutils Version: unspecified Status: UNCONFIRMED Severity: normal Priority: P2 Component: general Assignee: unassigned at sourceware dot org Reporter: wcventure at 126 dot com CC: elfutils-devel at sourceware dot org Target Milestone: --- Created attachment 11190 --> https://sourceware.org/bugzilla/attachment.cgi?id=3D11190&action=3Ded= it ./eu-elflint --strict @@ =3D=3D123497=3D=3DERROR: AddressSanitizer: heap-buffer-overflow on address 0x61300000dfd4 at pc 0x000000432311 bp 0x7ffc0e4d29c0 sp 0x7ffc0e4d29b0 READ of size 4 at 0x61300000dfd4 thread T0 #0 0x432310 in check_sysv_hash /home/wcventure/Documents/Cproject/elfutils/src/elflint.c:2055 #1 0x432310 in check_hash /home/wcventure/Documents/Cproject/elfutils/src/elflint.c:2355 #2 0x439613 in check_sections /home/wcventure/Documents/Cproject/elfutils/src/elflint.c:4161 #3 0x440395 in process_elf_file /home/wcventure/Documents/Cproject/elfutils/src/elflint.c:4739 #4 0x440395 in process_file /home/wcventure/Documents/Cproject/elfutils/src/elflint.c:242 #5 0x402e55 in main /home/wcventure/Documents/Cproject/elfutils/src/elflint.c:175 #6 0x7f81b5bba82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #7 0x403b08 in _start (/home/wcventure/Documents/Cproject/elfutils/build/bin/eu-elflint+0x403b08) 0x61300000dfd5 is located 0 bytes to the right of 341-byte region [0x61300000de80,0x61300000dfd5) allocated by thread T0 here: #0 0x7f81b64a4602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602) #1 0x7f81b61babff in convert_data /home/wcventure/Documents/Cproject/elfutils/libelf/elf_getdata.c:164 #2 0x7f81b61babff in __libelf_set_data_list_rdlock /home/wcventure/Documents/Cproject/elfutils/libelf/elf_getdata.c:431 SUMMARY: AddressSanitizer: heap-buffer-overflow /home/wcventure/Documents/Cproject/elfutils/src/elflint.c:2055 check_sysv_h= ash Shadow bytes around the buggy address: 0x0c267fff9ba0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c267fff9bb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c267fff9bc0: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c267fff9bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c267fff9be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =3D>0x0c267fff9bf0: 00 00 00 00 00 00 00 00 00 00[05]fa fa fa fa fa 0x0c267fff9c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c267fff9c10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c267fff9c20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c267fff9c30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c267fff9c40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07=20 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe =3D=3D123497=3D=3DABORTING --=20 You are receiving this mail because: You are on the CC list for the bug.