Hello,

I would like to report a sanitizer-detected violation in binutils 2.45 
(readelf).

I built readelf with sanitizers enabled using:

CC=clang
CFLAGS="-O1 -g -fno-omit-frame-pointer 
-fsanitize=address,undefined,integer,bounds"
LDFLAGS="-fsanitize=address,undefined,integer,bounds"

Observed result:

/root/build/binutils-2.45/binutils/readelf.c:24166:66: runtime error: implicit 
conversion from type 'int' of value -2 (32-bit, signed) to type 'unsigned long' 
changed the value to 18446744073709551614 (64-bit, unsigned)
#0 0x75205d in process_archive 
/root/build/binutils-2.45/binutils/readelf.c:24166:66
#1 0x74107c in process_file 
/root/build/binutils-2.45/binutils/readelf.c:24495:11
#2 0x73fed0 in main /root/build/binutils-2.45/binutils/readelf.c:25191:14
#3 0x7408b5 in main /root/build/binutils-2.45/binutils/readelf.c:25115:14
#4 0x7e43fe85fc86 in __libc_start_main 
/build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
#5 0x41c639 in _start 
(/work/build/binutils-2.45/obj-gcov2/binutils/readelf+0x41c639)

The corresponding code is:

arch.next_arhdr_offset += (filedata->archive_file_size + 1) & -2;

A possible fix would be to use an explicitly unsigned mask such as ~1UL here 
instead of -2.

Best regards,
Lingfeng Chen <https://aka.ms/GetOutlookForMac>

Reply via email to