[Bug libdw/28710] New: ERROR: AddressSanitizer: SEGV on unknown address (on i386)

[Bug libdw/28710] New: ERROR: AddressSanitizer: SEGV on unknown address (on i386)

[evvers at ya dot ru]

https://sourceware.org/bugzilla/show_bug.cgi?id=28710

            Bug ID: 28710
           Summary: ERROR: AddressSanitizer: SEGV on unknown address (on
                    i386)
           Product: elfutils
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libdw
          Assignee: unassigned at sourceware dot org
          Reporter: evvers at ya dot ru
                CC: elfutils-devel at sourceware dot org
  Target Milestone: ---

Created attachment 13861
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13861&action=edit
File triggering ASan

OSS-Fuzz reported a stack-use-after-return on i386 in
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42264. It can be
reproduced on an x86_64 Fedora machine by installing libc.i686, zlib-devel.i686
and libasan.i686 and building elfutils with -m32
```
autoreconf -i -f
./configure --enable-maintainer-mode --disable-debuginfod
--disable-libdebuginfod     --without-bzlib --without-lzma --without-zstd    
--enable-sanitize-address     CFLAGS="-m32 -g -O1" CXXFLAGS="-m32 -g -O1"
make -j$(nproc) V=1
$ ASAN_OPTIONS=detect_stack_use_after_return=1
LD_LIBRARY_PATH="./libdw;./libelf" ./src/stack --core ./oss-fuzz-42264
=================================================================
==13653==ERROR: AddressSanitizer: stack-use-after-return on address 0xf567a000
at pc 0xf7860e9b bp 0xffc10ae8 sp 0xffc10adc
READ of size 4 at 0xf567a000 thread T0
    #0 0xf7860e9a in dwfl_segment_report_module
/home/vagrant/elfutils/libdwfl/dwfl_segment_report_module.c:556
    #1 0xf786e251 in _new.dwfl_core_file_report
/home/vagrant/elfutils/libdwfl/core-file.c:559
    #2 0x804b78a in parse_opt /home/vagrant/elfutils/src/stack.c:595
    #3 0xf7457d4d in argp_parse (/lib/libc.so.6+0x11ed4d)
    #4 0x804caaa in main /home/vagrant/elfutils/src/stack.c:695
    #5 0xf735e468 in __libc_start_call_main (/lib/libc.so.6+0x25468)
    #6 0xf735e549 in __libc_start_main_impl (/lib/libc.so.6+0x25549)
    #7 0x804a57b in _start (/home/vagrant/elfutils/src/stack+0x804a57b)

Address 0xf567a000 is located in stack of thread T0 at offset 0 in frame
    #0 0xf786d0ef in dwfl_report_core_segments
/home/vagrant/elfutils/libdwfl/core-file.c:126

  This frame has 1 object(s):
    [32, 88) 'phdr_mem' (line 137)
```

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libdw/28710] ERROR: AddressSanitizer: SEGV on unknown address (on i386)

[mark at klomp dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28710

Mark Wielaard <mark at klomp dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mark at klomp dot org

--- Comment #1 from Mark Wielaard <mark at klomp dot org> ---
I cannot replicate this with my latest proposed patches.
I suspect this proposed patch fixed it:

https://sourceware.org/pipermail/elfutils-devel/2021q4/004557.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libdw/28710] ERROR: AddressSanitizer: SEGV on unknown address (on i386)

[evvers at ya dot ru]

https://sourceware.org/bugzilla/show_bug.cgi?id=28710

--- Comment #2 from Evgeny Vereshchagin <evvers at ya dot ru> ---
With https://code.wildebeest.org/git/user/mjw/elfutils/log/?h=fuzz rebased on
top of my "fuzzing" branch I can no longer reproduce this issue. Thanks!

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libdw/28710] ERROR: AddressSanitizer: SEGV on unknown address (on i386)

[mark at klomp dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28710

Mark Wielaard <mark at klomp dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #3 from Mark Wielaard <mark at klomp dot org> ---
Thanks for testing, I pushed all 13 commits from my fuzz branch.

-- 
You are receiving this mail because:
You are on the CC list for the bug.