https://sourceware.org/bugzilla/show_bug.cgi?id=33050
Bug ID: 33050
Summary: objcopy crashes due to heap corruption caused by a
negative-size memset in bfd_elf_set_group_contents.
Product: binutils
Version: 2.45 (HEAD)
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: binutils
Assignee: unassigned at sourceware dot org
Reporter: dragonarthurx at outlook dot com
Target Milestone: ---
Created attachment 16118
--> https://sourceware.org/bugzilla/attachment.cgi?id=16118&action=edit
poc file
Step to Reproduce:
git clone https://gitlab.com/gnutools/binutils-gdb.git
cd binutils-gdb
mkdir build
cd build
export CC=/root/go/bin/gclang
export CXX=/root/go/bin/gclang++
export CFLAGS="-g -O0 -fno-discard-value-names -fsanitize=address"
export CXXFLAGS="-g -O0 -fno-discard-value-names -fsanitize=address"
../configure --disable-shared --disable-gdb --disable-gdbserver
--disable-gdbsupport --disable-gnulib --disable-libdecnumber --disable-gas
--disable-gdb --disable-ld --disable-gold --disable-sim --disable-gprof
--disable-gprofing --disable-gprofng
make -j
binutils/objcopy -S -g -b 0 -i 4 /home/poc /tmp/output.o
binutils/objcopy: BFD (GNU Binutils) 2.44.50.20250603 assertion fail
../../bfd/elf.c:3957
=================================================================
==69364==ERROR: AddressSanitizer: negative-size-param: (size=-18)
#0 0x498399 in __asan_memset
(/home/binutils-gdb/build/binutils/objcopy+0x498399)
#1 0x63adec in bfd_elf_set_group_contents
/home/binutils-gdb/build/bfd/../../bfd/elf.c:3958:4
#2 0x576a9a in bfd_map_over_sections
/home/binutils-gdb/build/bfd/../../bfd/section.c:1387:5
#3 0x63c0b3 in _bfd_elf_compute_section_file_positions
/home/binutils-gdb/build/bfd/../../bfd/elf.c:4642:7
#4 0x65d5e1 in _bfd_elf_set_section_contents
/home/binutils-gdb/build/bfd/../../bfd/elf.c:9965:12
#5 0x577028 in bfd_set_section_contents
/home/binutils-gdb/build/bfd/../../bfd/section.c:1527:7
#6 0x4e474f in copy_section
/home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4677:12
#7 0x4da989 in copy_object
/home/binutils-gdb/build/binutils/../../binutils/objcopy.c:3408:10
#8 0x4d4540 in copy_file
/home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4028:10
#9 0x4cf4b0 in copy_main
/home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6187:3
#10 0x4cadef in main
/home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6291:5
#11 0x7f715e122082 in __libc_start_main
/build/glibc-FcRMwW/glibc-2.31/csu/../csu/libc-start.c:308:16
#12 0x41c58d in _start (/home/binutils-gdb/build/binutils/objcopy+0x41c58d)
0x62100001306c is located 876 bytes inside of 4064-byte region
[0x621000012d00,0x621000013ce0)
allocated by thread T0 here:
#0 0x498d3d in __interceptor_malloc
(/home/binutils-gdb/build/binutils/objcopy+0x498d3d)
#1 0x9577f6 in _objalloc_alloc
/home/binutils-gdb/build/libiberty/../../libiberty/objalloc.c:159:41
#2 0x569770 in bfd_alloc
/home/binutils-gdb/build/bfd/../../bfd/libbfd.c:453:9
#3 0x56982c in bfd_zalloc
/home/binutils-gdb/build/bfd/../../bfd/libbfd.c:478:9
#4 0x6416b0 in assign_section_numbers
/home/binutils-gdb/build/bfd/../../bfd/elf.c:4142:36
#5 0x63be83 in _bfd_elf_compute_section_file_positions
/home/binutils-gdb/build/bfd/../../bfd/elf.c:4622:8
#6 0x65d5e1 in _bfd_elf_set_section_contents
/home/binutils-gdb/build/bfd/../../bfd/elf.c:9965:12
#7 0x577028 in bfd_set_section_contents
/home/binutils-gdb/build/bfd/../../bfd/section.c:1527:7
#8 0x4e474f in copy_section
/home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4677:12
#9 0x4da989 in copy_object
/home/binutils-gdb/build/binutils/../../binutils/objcopy.c:3408:10
#10 0x4d4540 in copy_file
/home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4028:10
#11 0x4cf4b0 in copy_main
/home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6187:3
#12 0x4cadef in main
/home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6291:5
#13 0x7f715e122082 in __libc_start_main
/build/glibc-FcRMwW/glibc-2.31/csu/../csu/libc-start.c:308:16
SUMMARY: AddressSanitizer: negative-size-param
(/home/binutils-gdb/build/binutils/objcopy+0x498399) in __asan_memset
==69364==ABORTING
--
You are receiving this mail because:
You are on the CC list for the bug.
