Date: Sat, 16 Mar 2024 13:18:24 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 277736] llvm-objdump can crash due to ELFFile<ELFT>::dynamicEntries() not checking p_offset Message-ID: <bug-277736-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D277736 Bug ID: 277736 Summary: llvm-objdump can crash due to ELFFile<ELFT>::dynamicEntries() not checking p_offset Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: bin Assignee: bugs@FreeBSD.org Reporter: rtm@lcs.mit.edu Created attachment 249216 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D249216&action= =3Dedit a corrupt ELF file that causes llvm-objdump to crash This line in llvm-project/llvm/lib/Object/ELF.cpp dynamicEntries() forms a pointer from p_offset without checking whether it's too large: Dyn =3D ArrayRef(reinterpret_cast<const Elf_Dyn *>(base() + Phdr.p_of= fset), Phdr.p_filesz / sizeof(Elf_Dyn)); As a result a corrupt ELF file can cause objdump to crash. I've attached a demo. # uname -a FreeBSD stock14 15.0-CURRENT FreeBSD 15.0-CURRENT #19 main-n268743-a58813fd701e: Sat Mar 9 07:18:21 AST 2024=20=20=20=20 root@stock14:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64 # objdump --version LLVM (http://llvm.org/): LLVM version 17.0.6 Optimized build with assertions. ... # objdump -p ldd1b.exe=20 ... PLEASE submit a bug report to https://bugs.freebsd.org/submit/ and include = the crash backtrace. Stack dump: 0. Program arguments: objdump -p ldd1b.exe #0 0x0000000001230c41 PrintStackTrace /usr/src/contrib/llvm-project/llvm/lib/Support/Unix/Signals.inc:602:13 #1 0x000000000122f0b5 RunSignalHandlers /usr/src/contrib/llvm-project/llvm/lib/Support/Signals.cpp:105:18 #2 0x0000000001231365 SignalHandler /usr/src/contrib/llvm-project/llvm/lib/Support/Unix/Signals.inc:0:3 #3 0x00000008249cf5ff handle_signal /usr/src/lib/libthr/thread/thr_sig.c:0= :3 #4 0x00000008249cebbb thr_sighandler /usr/src/lib/libthr/thread/thr_sig.c:244:1 #5 0x000000082270d2d3 ([vdso]+0x2d3) #6 0x0000000000f96641 dynamicEntries /usr/src/contrib/llvm-project/llvm/lib/Object/ELF.cpp:590:24 #7 0x0000000000df2268 operator bool /usr/src/contrib/llvm-project/llvm/include/llvm/Support/Error.h:559:17 #8 0x0000000000df2268 printDynamicSection /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/ELFDump.cpp:205:8 #9 0x0000000000df2268 printPrivateHeaders /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/ELFDump.cpp:431:3 #10 0x0000000000e6a13c dumpObject /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/llvm-objdump.cpp:2815= :7 #11 0x0000000000e654b0 dumpInput /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/llvm-objdump.cpp:0:5 #12 0x0000000000e654b0 for_each<std::__1::__wrap_iter<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > *>, void (*)(llvm::StringRef)> /usr/obj/usr/src/amd64.amd64/tmp/usr/include/c++/v1/__algorithm/for_each.h:= 26:5 #13 0x0000000000e654b0 for_each<std::__1::vector<std::__1::basic_string<cha= r, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char= >, std::__1::allocator<char> > > > &, void (*)(llvm::StringRef)> /usr/src/contrib/llvm-project/llvm/include/llvm/ADT/STLExtras.h:1731:10 #14 0x0000000000e654b0 main /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/llvm-objdump.cpp:3248= :3 #15 0x0000000828a2d0aa __libc_start1 /usr/src/lib/libc/csu/libc_start1.c:15= 7:2 Bus error (core dumped) --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-277736-227>