From: "evvers at ya dot ru" <sourceware-bugzilla@sourceware.org>
To: elfutils-devel@sourceware.org
Subject: [Bug libelf/29000] Conditional jump or move depends on uninitialised value in elf_compress_gnu
Date: Fri, 25 Mar 2022 11:17:52 +0000 [thread overview]
Message-ID: <bug-29000-10460-JlESiJydY2@http.sourceware.org/bugzilla/> (raw)
In-Reply-To: <bug-29000-10460@http.sourceware.org/bugzilla/>
https://sourceware.org/bugzilla/show_bug.cgi?id=29000
--- Comment #1 from Evgeny Vereshchagin <evvers at ya dot ru> ---
Created attachment 14036
--> https://sourceware.org/bugzilla/attachment.cgi?id=14036&action=edit
file triggering issue in fuzz-libdwfl
The same issue was found by fuzz-libdwfl.
```
make -C tests fuzz-libdwfl
LD_LIBRARY_PATH="$(pwd)/libelf;$(pwd)/libdw" DEBUGINFOD_URLS= valgrind
--track-origins=yes ./tests/fuzz-libdwfl
../clusterfuzz-testcase-minimized-fuzz-libdwfl-4725021634854912
```
```
Running: ../clusterfuzz-testcase-minimized-fuzz-libdwfl-4725021634854912
==65641== Conditional jump or move depends on uninitialised value(s)
==65641== at 0x4868734: elf_compress_gnu (elf_compress_gnu.c:155)
==65641== by 0x489EF0E: check_section (dwarf_begin_elf.c:210)
==65641== by 0x489F6D2: global_read (dwarf_begin_elf.c:409)
==65641== by 0x489F6D2: dwarf_begin_elf (dwarf_begin_elf.c:560)
==65641== by 0x48C033C: load_dw (dwfl_module_getdwarf.c:1342)
==65641== by 0x48C0500: find_dw (dwfl_module_getdwarf.c:1392)
==65641== by 0x48C0500: dwfl_module_getdwarf (dwfl_module_getdwarf.c:1447)
==65641== by 0x401512: LLVMFuzzerTestOneInput (fuzz-libdwfl.c:45)
==65641== by 0x401248: main (fuzz-main.c:33)
==65641== Uninitialised value was created by a heap allocation
==65641== at 0x484486F: malloc (vg_replace_malloc.c:381)
==65641== by 0x48606C6: convert_data (elf_getdata.c:168)
==65641== by 0x48606C6: __libelf_set_data_list_rdlock (elf_getdata.c:457)
==65641== by 0x48608C7: __elf_getdata_rdlock (elf_getdata.c:564)
==65641== by 0x486870A: elf_compress_gnu (elf_compress_gnu.c:150)
==65641== by 0x489EF0E: check_section (dwarf_begin_elf.c:210)
==65641== by 0x489F6D2: global_read (dwarf_begin_elf.c:409)
==65641== by 0x489F6D2: dwarf_begin_elf (dwarf_begin_elf.c:560)
==65641== by 0x48C033C: load_dw (dwfl_module_getdwarf.c:1342)
==65641== by 0x48C0500: find_dw (dwfl_module_getdwarf.c:1392)
==65641== by 0x48C0500: dwfl_module_getdwarf (dwfl_module_getdwarf.c:1447)
==65641== by 0x401512: LLVMFuzzerTestOneInput (fuzz-libdwfl.c:45)
==65641== by 0x401248: main (fuzz-main.c:33)
==65641==
Done: ../clusterfuzz-testcase-minimized-fuzz-libdwfl-4725021634854912: (1087
bytes)
```
--
You are receiving this mail because:
You are on the CC list for the bug.
next prev parent reply other threads:[~2022-03-25 11:17 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-25 0:09 [Bug libelf/29000] New: " evvers at ya dot ru
2022-03-25 11:17 ` evvers at ya dot ru [this message]
2022-03-25 13:01 ` [Bug libelf/29000] " mark at klomp dot org
2022-03-29 22:35 ` mark at klomp dot org
2022-03-30 10:06 ` evvers at ya dot ru
2022-03-30 14:48 ` mark at klomp dot org
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-29000-10460-JlESiJydY2@http.sourceware.org/bugzilla/ \
--to=sourceware-bugzilla@sourceware.org \
--cc=elfutils-devel@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).