From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id E6DEC3858D28; Fri, 24 Dec 2021 08:05:12 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E6DEC3858D28 From: "evvers at ya dot ru" To: elfutils-devel@sourceware.org Subject: [Bug libdw/28720] UBSan: member access within misaligned address 0x7f6e8d80f142 for type 'struct Elf32_Phdr', which requires 4 byte alignment Date: Fri, 24 Dec 2021 08:05:12 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: elfutils X-Bugzilla-Component: libdw X-Bugzilla-Version: unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: evvers at ya dot ru X-Bugzilla-Status: ASSIGNED X-Bugzilla-Resolution: X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: mark at klomp dot org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: elfutils-devel@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Elfutils-devel mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Dec 2021 08:05:13 -0000 https://sourceware.org/bugzilla/show_bug.cgi?id=3D28720 --- Comment #3 from Evgeny Vereshchagin --- As far as I can see with the fuzz branch rebased on top on my fuzzing branch almost all the issues including https://sourceware.org/pipermail/elfutils-devel/2021q4/004596.html are gone. Thanks! I'll attach files triggering the remaining issues shortly: ``` $ UBSAN_OPTIONS=3Dprint_stacktrace=3D1:print_summary=3D1:halt_on_error=3D1 LD_LIBRARY_PATH=3D"./libdw;./libelf" ./src/stack --core SIGABRT.PC.7fffe4f4e84c.STACK.18f0f46b60.CODE.-6.ADDR.0.INSTR.mov____%eax,%= ebp.fuzz link_map.c:1040:20: runtime error: variable length array bound evaluates to non-positive value 0 #0 0x7fbc58f053e9 in dwfl_link_map_report /home/vagrant/elfutils/libdwfl/link_map.c:1040 #1 0x7fbc59023fa7 in _new.dwfl_core_file_report /home/vagrant/elfutils/libdwfl/core-file.c:552 #2 0x4053f7 in parse_opt /home/vagrant/elfutils/src/stack.c:595 #3 0x7fbc581d9471 in argp_parse (/lib64/libc.so.6+0x11e471) #4 0x404b39 in main /home/vagrant/elfutils/src/stack.c:695 #5 0x7fbc580e855f in __libc_start_call_main (/lib64/libc.so.6+0x2d55f) #6 0x7fbc580e860b in __libc_start_main_impl (/lib64/libc.so.6+0x2d60b) #7 0x404fa4 in _start (/home/vagrant/elfutils/src/stack+0x404fa4) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior link_map.c:1040:20 = in ``` ``` $ UBSAN_OPTIONS=3Dprint_stacktrace=3D1:print_summary=3D1:halt_on_error=3D1 LD_LIBRARY_PATH=3D"./libdw;./libelf" ./src/stack --core SIGABRT.PC.7fffe4f4e84c.STACK.1976b2f3ff.CODE.-6.ADDR.0.INSTR.mov____%eax,%= ebp.fuzz gelf_xlate.h:48:1: runtime error: member access within misaligned address 0x7f0817719077 for type 'struct Elf32_Dyn', which requires 4 byte alignment 0x7f0817719077: note: pointer points here 00 10 00 00 00 00 00 00 00 00 02 01 00 00 00 00 00 00 7f 45 46 4c 46 00= 00 01 01 00 01 00 08 00 ^ #0 0x7f0822689542 in Elf32_cvt_Dyn /home/vagrant/elfutils/libelf/gelf_xlate.h:48 #1 0x7f082268835e in elf32_xlatetom /home/vagrant/elfutils/libelf/elf32_xlatetom.c:104 #2 0x7f0819563307 in dwfl_segment_report_module /home/vagrant/elfutils/libdwfl/dwfl_segment_report_module.c:848 #3 0x7f081956c06c in _new.dwfl_core_file_report /home/vagrant/elfutils/libdwfl/core-file.c:563 #4 0x4053f7 in parse_opt /home/vagrant/elfutils/src/stack.c:595 #5 0x7f0818721471 in argp_parse (/lib64/libc.so.6+0x11e471) #6 0x404b39 in main /home/vagrant/elfutils/src/stack.c:695 #7 0x7f081863055f in __libc_start_call_main (/lib64/libc.so.6+0x2d55f) #8 0x7f081863060b in __libc_start_main_impl (/lib64/libc.so.6+0x2d60b) #9 0x404fa4 in _start (/home/vagrant/elfutils/src/stack+0x404fa4) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior gelf_xlate.h:48:1 in ``` --=20 You are receiving this mail because: You are on the CC list for the bug.=