78 lines
No EOL
4.8 KiB
Text
78 lines
No EOL
4.8 KiB
Text
Source: https://sourceware.org/bugzilla/show_bug.cgi?id=21580
|
|
|
|
I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.
|
|
|
|
Please find attached the minimized file causing the issue ("Input") and the
|
|
ASAN report log ("Output"). Below is the reduced stacktrace with links to the
|
|
corresponding source lines on a GitHub mirror.
|
|
|
|
The command I used was `objdump -D <file>`.
|
|
|
|
Let me know if there is any additional information I can provide.
|
|
|
|
--
|
|
|
|
Input: 37a2b1374545eb23eed0eea880de6226.ad5cda09828cea9d238db2184e95406b.min
|
|
Output: 37a2b1374545eb23eed0eea880de6226.ad5cda09828cea9d238db2184e95406b.txt
|
|
|
|
Error in "disassemble_bytes": heap-buffer-overflow
|
|
in disassemble_bytes at binutils/objdump.c:1993
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L1993)
|
|
in disassemble_section at binutils/objdump.c:2309
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2309)
|
|
in bfd_map_over_sections at bfd/section.c:1395
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/section.c#L1395)
|
|
in disassemble_data at binutils/objdump.c:2445
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2445)
|
|
in dump_bfd at binutils/objdump.c:3547
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3547)
|
|
in display_file at binutils/objdump.c:3714
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
|
|
in main at binutils/objdump.c:4016
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)
|
|
|
|
Input: 77125fccb44694b0db18006db1f0f4d3.64e76dd7ab33d15c8293caeca73c704a.min
|
|
Output: 77125fccb44694b0db18006db1f0f4d3.64e76dd7ab33d15c8293caeca73c704a.txt
|
|
|
|
Error in "disassemble_bytes": heap-buffer-overflow
|
|
in disassemble_bytes at binutils/objdump.c:1932
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L1932)
|
|
in disassemble_section at binutils/objdump.c:2309
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2309)
|
|
in bfd_map_over_sections at bfd/section.c:1395
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/section.c#L1395)
|
|
in disassemble_data at binutils/objdump.c:2445
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2445)
|
|
in dump_bfd at binutils/objdump.c:3547
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3547)
|
|
in display_file at binutils/objdump.c:3714
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
|
|
in main at binutils/objdump.c:4016
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)
|
|
|
|
Input: c3269b8eae3f3ec0001d835e66795702.6e6557284eb14f91acf6c2576396517c.min
|
|
Output: c3269b8eae3f3ec0001d835e66795702.6e6557284eb14f91acf6c2576396517c.txt
|
|
|
|
Error in "disassemble_bytes": heap-buffer-overflow
|
|
in disassemble_bytes at binutils/objdump.c:1926
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L1926)
|
|
in disassemble_section at binutils/objdump.c:2309
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2309)
|
|
in bfd_map_over_sections at bfd/section.c:1395
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/section.c#L1395)
|
|
in disassemble_data at binutils/objdump.c:2445
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2445)
|
|
in dump_bfd at binutils/objdump.c:3547
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3547)
|
|
in display_file at binutils/objdump.c:3714
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
|
|
in main at binutils/objdump.c:4016
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)
|
|
|
|
|
|
Additional Information:
|
|
The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.
|
|
|
|
|
|
Proofs of Concept:
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42199.zip |