44 lines
No EOL
3 KiB
Text
44 lines
No EOL
3 KiB
Text
Source: https://sourceware.org/bugzilla/show_bug.cgi?id=21595
|
|
|
|
I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.
|
|
|
|
Please find attached the minimized file causing the issue ("Input") and the ASAN report log ("Output"). Below is the reduced stacktrace with links to the corresponding source lines on a GitHub mirror.
|
|
|
|
The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.
|
|
|
|
Let me know if there is any additional information I can provide.
|
|
|
|
--
|
|
|
|
Input: 3ade4a4333249762a9df82c47f3c111a.65dbcbffa0f6467be847e1372688623b.min
|
|
Output: 3ade4a4333249762a9df82c47f3c111a.65dbcbffa0f6467be847e1372688623b.txt
|
|
|
|
Error in "aarch64_ext_ldst_reglist": global-buffer-overflow
|
|
in aarch64_ext_ldst_reglist at opcodes/aarch64-dis.c:412
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/aarch64-dis.c#L412)
|
|
in aarch64_opcode_decode at opcodes/aarch64-dis.c:2739
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/aarch64-dis.c#L2739)
|
|
in aarch64_decode_insn at opcodes/aarch64-dis.c:2831
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/aarch64-dis.c#L2831)
|
|
in print_insn_aarch64_word at opcodes/aarch64-dis.c:2973
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/aarch64-dis.c#L2973)
|
|
in print_insn_aarch64 at opcodes/aarch64-dis.c:3209
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/aarch64-dis.c#L3209)
|
|
in disassemble_bytes at binutils/objdump.c:1864
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L1864)
|
|
in disassemble_section at binutils/objdump.c:2309
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2309)
|
|
in bfd_map_over_sections at bfd/section.c:1395
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/section.c#L1395)
|
|
in disassemble_data at binutils/objdump.c:2445
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2445)
|
|
in dump_bfd at binutils/objdump.c:3547
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3547)
|
|
in display_file at binutils/objdump.c:3714
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
|
|
in main at binutils/objdump.c:4016
|
|
(see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)
|
|
|
|
|
|
Proof of Concept:
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42204.zip |