[Bug binutils/23142] New: objcopy: SIGSEGV in is_strip_section

[paolo.montesel+sourceware at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23142

Bug ID: 23142
Summary: objcopy: SIGSEGV in is_strip_section
Product: binutils
Version: 2.31 (HEAD)
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: binutils
Assignee: unassigned at sourceware dot org
Reporter: paolo.montesel+sourceware at gmail dot com
Target Milestone: ---

Created attachment 10992
--> https://sourceware.org/bugzilla/attachment.cgi?id=10992&action=edit
crash

As part of a tool I'm writing I fuzzed binutils. The attached file makes
objcopy crash inside `is_strip_section`:

Program received signal SIGSEGV, Segmentation fault.
is_strip_section (sec=***@entry=0x730950, abfd=0x72ef40) at objcopy.c:1352
1352 gname = gsym->name;
#0 is_strip_section (sec=***@entry=0x730950, abfd=0x72ef40) at objcopy.c:1352
#1 0x0000000000406db5 in skip_section (ibfd=0x72ef40, isection=0x730950,
skip_copy=1) at objcopy.c:3849
#2 0x0000000000406e4f in copy_section (ibfd=0x72ef40, isection=0x730950,
obfdarg=0x7322e0) at objcopy.c:4026
#3 0x000000000042639c in bfd_map_over_sections (abfd=***@entry=0x72ef40,
operation=***@entry=0x406e20 <copy_section>,
user_storage=***@entry=0x7322e0) at section.c:1391
#4 0x0000000000408864 in copy_object (ibfd=<optimized out>, obfd=<optimized
out>, input_arch=<optimized out>) at objcopy.c:3057
#5 0x000000000040a63a in copy_file
(input_filename=***@entry=0x7fffffffe131 "id:000010,sig:1"...,
output_filename=***@entry=0x7fffffffe164 "/dev/null",
input_target=***@entry=0x0, output_target=<optimized out>,
***@entry=0x0, input_arch=***@entry=0x0) at objcopy.c:3532
#6 0x0000000000403334 in copy_main (argv=<optimized out>, argc=<optimized
out>) at objcopy.c:5484
#7 main (argc=***@entry=3, argv=***@entry=0x7fffffffdd88) at objcopy.c:5588
#8 0x00007ffff7829830 in __libc_start_main (main=0x402ea0 <main>, argc=3,
argv=0x7fffffffdd88, init=<optimized out>, fini=<optimized out>,
rtld_fini=<optimized out>, stack_end=0x7fffffffdd78) at ../csu/libc-start.c:291
#9 0x00000000004055c9 in _start ()

Compiled and tried against a freshly cloned repo. It also works on Ubuntu
Xenial's binutils (2.26.1).

[paolo.montesel+sourceware at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23142

--- Comment #1 from Paolo Montesel <paolo.montesel+sourceware at gmail dot com> ---
Created attachment 10993
--> https://sourceware.org/bugzilla/attachment.cgi?id=10993&action=edit
crash 2

[paolo.montesel+sourceware at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23142

--- Comment #2 from Paolo Montesel <paolo.montesel+sourceware at gmail dot com> ---
Created attachment 10994
--> https://sourceware.org/bugzilla/attachment.cgi?id=10994&action=edit
crash 3

[paolo.montesel+sourceware at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23142

--- Comment #3 from Paolo Montesel <paolo.montesel+sourceware at gmail dot com> ---
Crash 1 and 2 are actually the same file, sorry.

[amodra at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23142

Alan Modra <amodra at gmail dot com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |ASSIGNED
Last reconfirmed| |2018-05-07
CC| |amodra at gmail dot com
Assignee|unassigned at sourceware dot org |amodra at gmail dot com
Ever confirmed|0 |1

[amodra at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23142

Alan Modra <amodra at gmail dot com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |RESOLVED
CC|amodra at gmail dot com |
Resolution|--- |FIXED

--- Comment #5 from Alan Modra <amodra at gmail dot com> ---
Fixed

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=23142

--- Comment #4 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Alan Modra <***@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ce4ec1a9b6c442a9feefa18dd8734372a718665c

commit ce4ec1a9b6c442a9feefa18dd8734372a718665c
Author: Alan Modra <***@gmail.com>
Date: Mon May 7 22:41:47 2018 +0930

Bug 23142, SIGSEGV in is_strip_section

PR 23142
* objcopy.c (group_signature): Don't accept groups that use a
symbol table other than the one we've read.