From: "wcventure at 126 dot com" <sourceware-bugzilla@sourceware.org>
To: elfutils-devel@sourceware.org
Subject: [Bug general/23786] New: Divide-by-zero Problem in function arlib_add_symbols() in arlib.c in elfutils-0.174
Date: Wed, 17 Oct 2018 08:37:00 -0000 [thread overview]
Message-ID: <bug-23786-10460@http.sourceware.org/bugzilla/> (raw)
https://sourceware.org/bugzilla/show_bug.cgi?id=23786
Bug ID: 23786
Summary: Divide-by-zero Problem in function arlib_add_symbols()
in arlib.c in elfutils-0.174
Product: elfutils
Version: unspecified
Status: UNCONFIRMED
Severity: critical
Priority: P2
Component: general
Assignee: unassigned at sourceware dot org
Reporter: wcventure at 126 dot com
CC: elfutils-devel at sourceware dot org
Target Milestone: ---
Hi,
I found some floating point exception in function arlib_add_symbols() in
arlib.c of the latest elfutils-0.174 code base. I have confirmed them with GDB
and Address Sanitizer.
Here are the POC files. Please use " ./eu-ranlib $POC " to reproduce this bug.
I'll also show you the debugging process. It seems that this is caused by the
divide-by-zero.
In arlib.c:255, there exist a division calculation:
> int nsyms = shdr->sh_size / shdr->sh_entsize;
I can provide you some testcases to make shdr->sh_entsize = 0. And you can use
the testcases to reproduce the bug. Divide by zero is bad. We need to make a
check before doing division calculation.
--- Comment #1 from wcventure <wcventure at 126 dot com> ---
Created attachment 11336
--> https://sourceware.org/bugzilla/attachment.cgi?id=11336&action=edit
POC1
I have also confirmed them with Address Sanitizer.
The ASAN dumps the stack trace as follows:
ASAN:DEADLYSIGNAL
=================================================================
==2496==ERROR: AddressSanitizer: FPE on unknown address 0x0000004065d8 (pc
0x0000004065d8 bp 0x7ffd4c109620 sp 0x7ffd4c109550 T0)
#0 0x4065d7 in arlib_add_symbols
/media/hjwang/01D3344861A8D2E0/wcventure/Project/elfutils/src/arlib.c:255
#1 0x4029c5 in handle_file
/media/hjwang/01D3344861A8D2E0/wcventure/Project/elfutils/src/ranlib.c:193
#2 0x4029c5 in main
/media/hjwang/01D3344861A8D2E0/wcventure/Project/elfutils/src/ranlib.c:110
#3 0x7fc97b51982f in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#4 0x403d28 in _start
(/media/hjwang/01D3344861A8D2E0/wcventure/Project/elfutils/build/bin/eu-ranlib+0x403d28)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE
/media/hjwang/01D3344861A8D2E0/wcventure/Project/elfutils/src/arlib.c:255 in
arlib_add_symbols
==2496==ABORTING
Aborted
--
You are receiving this mail because:
You are on the CC list for the bug.
next reply other threads:[~2018-10-17 8:37 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-17 8:37 wcventure at 126 dot com [this message]
2018-10-17 8:38 ` [Bug general/23786] " wcventure at 126 dot com
2018-10-18 17:03 ` mark at klomp dot org
2018-10-19 22:58 ` mark at klomp dot org
2018-11-14 11:50 ` mark at klomp dot org
2018-11-14 11:56 ` [Bug tools/23786] " mark at klomp dot org
2020-03-16 9:10 ` mda.feedbck at gmail dot com
2020-08-21 9:42 ` scottswayer at gmail dot com
2020-11-22 14:50 ` hegdemegha216 at gmail dot com
2021-01-13 18:29 ` ittech.euh at gmail dot com
2021-01-13 19:09 ` mark at klomp dot org
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-23786-10460@http.sourceware.org/bugzilla/ \
--to=sourceware-bugzilla@sourceware.org \
--cc=elfutils-devel@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).