| Título | GNU binutils--gdb 2.45 Out-of-bounds Write |
|---|
| Descripción | objcopy crashes due to heap corruption caused by a negative-size memset in bfd_elf_set_group_contents.
binutils/objcopy -S -g -b 0 -i 4 /home/poc /tmp/output.o
binutils/objcopy: BFD (GNU Binutils) 2.44.50.20250603 assertion fail ../../bfd/elf.c:3957
=================================================================
==69364==ERROR: AddressSanitizer: negative-size-param: (size=-18)
#0 0x498399 in __asan_memset (/home/binutils-gdb/build/binutils/objcopy+0x498399)
#1 0x63adec in bfd_elf_set_group_contents /home/binutils-gdb/build/bfd/../../bfd/elf.c:3958:4
#2 0x576a9a in bfd_map_over_sections /home/binutils-gdb/build/bfd/../../bfd/section.c:1387:5
#3 0x63c0b3 in _bfd_elf_compute_section_file_positions /home/binutils-gdb/build/bfd/../../bfd/elf.c:4642:7
#4 0x65d5e1 in _bfd_elf_set_section_contents /home/binutils-gdb/build/bfd/../../bfd/elf.c:9965:12
#5 0x577028 in bfd_set_section_contents /home/binutils-gdb/build/bfd/../../bfd/section.c:1527:7
#6 0x4e474f in copy_section /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4677:12
#7 0x4da989 in copy_object /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:3408:10
#8 0x4d4540 in copy_file /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4028:10
#9 0x4cf4b0 in copy_main /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6187:3
#10 0x4cadef in main /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6291:5
#11 0x7f715e122082 in __libc_start_main /build/glibc-FcRMwW/glibc-2.31/csu/../csu/libc-start.c:308:16
#12 0x41c58d in _start (/home/binutils-gdb/build/binutils/objcopy+0x41c58d)
0x62100001306c is located 876 bytes inside of 4064-byte region [0x621000012d00,0x621000013ce0)
allocated by thread T0 here:
#0 0x498d3d in __interceptor_malloc (/home/binutils-gdb/build/binutils/objcopy+0x498d3d)
#1 0x9577f6 in _objalloc_alloc /home/binutils-gdb/build/libiberty/../../libiberty/objalloc.c:159:41
#2 0x569770 in bfd_alloc /home/binutils-gdb/build/bfd/../../bfd/libbfd.c:453:9
#3 0x56982c in bfd_zalloc /home/binutils-gdb/build/bfd/../../bfd/libbfd.c:478:9
#4 0x6416b0 in assign_section_numbers /home/binutils-gdb/build/bfd/../../bfd/elf.c:4142:36
#5 0x63be83 in _bfd_elf_compute_section_file_positions /home/binutils-gdb/build/bfd/../../bfd/elf.c:4622:8
#6 0x65d5e1 in _bfd_elf_set_section_contents /home/binutils-gdb/build/bfd/../../bfd/elf.c:9965:12
#7 0x577028 in bfd_set_section_contents /home/binutils-gdb/build/bfd/../../bfd/section.c:1527:7
#8 0x4e474f in copy_section /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4677:12
#9 0x4da989 in copy_object /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:3408:10
#10 0x4d4540 in copy_file /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4028:10
#11 0x4cf4b0 in copy_main /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6187:3
#12 0x4cadef in main /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6291:5
#13 0x7f715e122082 in __libc_start_main /build/glibc-FcRMwW/glibc-2.31/csu/../csu/libc-start.c:308:16
SUMMARY: AddressSanitizer: negative-size-param (/home/binutils-gdb/build/binutils/objcopy+0x498399) in __asan_memset
==69364==ABORTING |
|---|
| Fuente | ⚠️ https://sourceware.org/bugzilla/show_bug.cgi?id=33050 |
|---|
| Usuario | arthurx (UID 87796) |
|---|
| Sumisión | 2025-07-11 09:46 (hace 1 Año) |
|---|
| Moderación | 2025-07-12 19:00 (1 day later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 316244 [GNU Binutils 2.45 bfd/elf.c bfd_elf_set_group_contents desbordamiento de búfer] |
|---|
| Puntos | 20 |
|---|