Submit #614355: GNU binutils--gdb 2.45 Heap-based Buffer Overflow

Heap-buffer-overflow in objcopy when using --interleave and --byte options on a crafted binary input

./binutils/objcopy -I binary -O elf64-x86-64 "--output-target=elf64-x86-64" "--byte=0" "--interleave=4" "--interleave-width=2" "--remove-section=.debug_info" -S /home/poc /tmp/output_file.o

ASan output:
=================================================================
==64150==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000000b1 at pc 0x00000043682e bp 0x7ffc172f68c0 sp 0x7ffc172f6088
READ of size 2 at 0x6020000000b1 thread T0
#0 0x43682d in __interceptor_fwrite (/home/binutils-gdb/build/binutils/objcopy+0x43682d)
#1 0x89cd46 in cache_bwrite /home/binutils-gdb/build/bfd/../../bfd/cache.c:435:12
#2 0x55040e in bfd_write /home/binutils-gdb/build/bfd/../../bfd/bfdio.c:412:12
#3 0x56d8af in _bfd_generic_set_section_contents /home/binutils-gdb/build/bfd/../../bfd/libbfd.c:1351:10
#4 0x65d7e8 in _bfd_elf_set_section_contents /home/binutils-gdb/build/bfd/../../bfd/elf.c:10008:10
#5 0x577028 in bfd_set_section_contents /home/binutils-gdb/build/bfd/../../bfd/section.c:1527:7
#6 0x4e474f in copy_section /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4677:12
#7 0x4da989 in copy_object /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:3408:10
#8 0x4d4540 in copy_file /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4028:10
#9 0x4cf4b0 in copy_main /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6187:3
#10 0x4cadef in main /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6291:5
#11 0x7f2149ab0082 in __libc_start_main /build/glibc-FcRMwW/glibc-2.31/csu/../csu/libc-start.c:308:16
#12 0x41c58d in _start (/home/binutils-gdb/build/binutils/objcopy+0x41c58d)

0x6020000000b1 is located 0 bytes to the right of 1-byte region [0x6020000000b0,0x6020000000b1)
allocated by thread T0 here:
#0 0x498d3d in __interceptor_malloc (/home/binutils-gdb/build/binutils/objcopy+0x498d3d)
#1 0x569342 in bfd_malloc /home/binutils-gdb/build/bfd/../../bfd/libbfd.c:291:9
#2 0x5561e1 in bfd_get_full_section_contents /home/binutils-gdb/build/bfd/../../bfd/compress.c:744:21
#3 0x4e3eca in copy_section /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4610:12
#4 0x4da989 in copy_object /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:3408:10
#5 0x4d4540 in copy_file /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:4028:10
#6 0x4cf4b0 in copy_main /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6187:3
#7 0x4cadef in main /home/binutils-gdb/build/binutils/../../binutils/objcopy.c:6291:5
#8 0x7f2149ab0082 in __libc_start_main /build/glibc-FcRMwW/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/binutils-gdb/build/binutils/objcopy+0x43682d) in __interceptor_fwrite
Shadow bytes around the buggy address:
0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff8000: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
=>0x0c047fff8010: fa fa 00 01 fa fa[01]fa fa fa fa fa fa fa fa fa
0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==64150==ABORTING

• Source: ⚠️ https://sourceware.org/bugzilla/show_bug.cgi?id=33049
• User: arthurx (UID 87796)
• Submission: 07/11/2025 09:31 AM (9 months ago)
• Moderation: 07/12/2025 07:00 PM (1 day later)
• Status: Accepted
• VulDB entry: 316243 [GNU Binutils 2.45 binutils/objcopy.c copy_section heap-based overflow]
• Points: 20