[Bug binutils/21929] memory exhaustion

[499671216 at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=21929

--- Comment #2 from Zhihua Yao <499671216 at qq dot com> ---
==23762==AddressSanitizer CHECK failed:
../../../../src/libsanitizer/sanitizer_common/sanitizer_posix.cc:66 "(("unable
to mmap" && 0)) != (0)" (0x0, 0x0)
#0 0xb72f94c1 (/usr/lib/i386-linux-gnu/libasan.so.1+0x544c1)
#1 0xb72fd6a9 in __sanitizer::CheckFailed(char const*, int, char const*,
unsigned long long, unsigned long long)
(/usr/lib/i386-linux-gnu/libasan.so.1+0x586a9)
#2 0xb7302e22 (/usr/lib/i386-linux-gnu/libasan.so.1+0x5de22)
#3 0xb72bd99b (/usr/lib/i386-linux-gnu/libasan.so.1+0x1899b)
#4 0xb72be488 (/usr/lib/i386-linux-gnu/libasan.so.1+0x19488)
#5 0xb72f384a in __interceptor_malloc
(/usr/lib/i386-linux-gnu/libasan.so.1+0x4e84a)
#6 0x82c87c6 in bfd_malloc /home/hjy/Desktop/binutils-2.29/bfd/libbfd.c:193
#7 0x8570c34 in aout_get_external_symbols
/home/hjy/Desktop/binutils-2.29/bfd/aoutx.h:1325
#8 0x859cd20 in aout_32_slurp_symbol_table
/home/hjy/Desktop/binutils-2.29/bfd/aoutx.h:1757
#9 0x859cd20 in aout_32_get_symtab_upper_bound
/home/hjy/Desktop/binutils-2.29/bfd/aoutx.h:2522
#10 0x8069aee in slurp_symtab objdump.c:615
#11 0x8069aee in dump_bfd objdump.c:3515
#12 0x806e16e in display_object_bfd objdump.c:3603
#13 0x806e16e in display_any_bfd objdump.c:3692
#14 0x805837d in display_file objdump.c:3713
#15 0x805837d in main objdump.c:4015
#16 0xb7109a82 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x19a82)
#17 0x805af8f (/usr/local/bin/objdump+0x805af8f)

[499671216 at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=21929

--- Comment #3 from Zhihua Yao <499671216 at qq dot com> ---
Created attachment 10328
--> https://sourceware.org/bugzilla/attachment.cgi?id=10328&action=edit
oom-objdump3

[499671216 at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=21929

Zhihua Yao <499671216 at qq dot com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Attachment #10327|testcase2 |oom-objdump2
description| |

[499671216 at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=21929

--- Comment #1 from Zhihua Yao <499671216 at qq dot com> ---
Created attachment 10327
--> https://sourceware.org/bugzilla/attachment.cgi?id=10327&action=edit
testcase2

[499671216 at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=21929

Zhihua Yao <499671216 at qq dot com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Attachment #10326|testcase |oom-objdump1
description| |

[499671216 at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=21929

--- Comment #4 from Zhihua Yao <499671216 at qq dot com> ---
==8747==AddressSanitizer CHECK failed:
../../../../src/libsanitizer/sanitizer_common/sanitizer_posix.cc:66 "(("unable
to mmap" && 0)) != (0)" (0x0, 0x0)
#0 0xb72244c1 (/usr/lib/i386-linux-gnu/libasan.so.1+0x544c1)
#1 0xb72286a9 in __sanitizer::CheckFailed(char const*, int, char const*,
unsigned long long, unsigned long long)
(/usr/lib/i386-linux-gnu/libasan.so.1+0x586a9)
#2 0xb722de22 (/usr/lib/i386-linux-gnu/libasan.so.1+0x5de22)
#3 0xb71e899b (/usr/lib/i386-linux-gnu/libasan.so.1+0x1899b)
#4 0xb71e9488 (/usr/lib/i386-linux-gnu/libasan.so.1+0x19488)
#5 0xb721e84a in __interceptor_malloc
(/usr/lib/i386-linux-gnu/libasan.so.1+0x4e84a)
#6 0x8877f98 in _objalloc_alloc objalloc.c:143
#7 0x82d9bc5 in bfd_alloc /home/hjy/Desktop/binutils-2.29/bfd/opncls.c:958
#8 0x85d16a3 in pe_ILF_object_p
/home/hjy/Desktop/binutils-2.29/bfd/peicode.h:1261
#9 0x85d16a3 in pe_bfd_object_p
/home/hjy/Desktop/binutils-2.29/bfd/peicode.h:1408
#10 0x82bd375 in bfd_check_format_matches
/home/hjy/Desktop/binutils-2.29/bfd/format.c:311
#11 0x806e0e1 in display_object_bfd objdump.c:3601
#12 0x806e0e1 in display_any_bfd objdump.c:3692
#13 0x805837d in display_file objdump.c:3713
#14 0x805837d in main objdump.c:4015
#15 0xb7034a82 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x19a82)
#16 0x805af8f (/usr/local/bin/objdump+0x805af8f)

[499671216 at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=21929

--- Comment #4 from Zhihua Yao <499671216 at qq dot com> ---
==8747==AddressSanitizer CHECK failed:
../../../../src/libsanitizer/sanitizer_common/sanitizer_posix.cc:66 "(("unable
to mmap" && 0)) != (0)" (0x0, 0x0)
#0 0xb72244c1 (/usr/lib/i386-linux-gnu/libasan.so.1+0x544c1)
#1 0xb72286a9 in __sanitizer::CheckFailed(char const*, int, char const*,
unsigned long long, unsigned long long)
(/usr/lib/i386-linux-gnu/libasan.so.1+0x586a9)
#2 0xb722de22 (/usr/lib/i386-linux-gnu/libasan.so.1+0x5de22)
#3 0xb71e899b (/usr/lib/i386-linux-gnu/libasan.so.1+0x1899b)
#4 0xb71e9488 (/usr/lib/i386-linux-gnu/libasan.so.1+0x19488)
#5 0xb721e84a in __interceptor_malloc
(/usr/lib/i386-linux-gnu/libasan.so.1+0x4e84a)
#6 0x8877f98 in _objalloc_alloc objalloc.c:143
#7 0x82d9bc5 in bfd_alloc /home/hjy/Desktop/binutils-2.29/bfd/opncls.c:958
#8 0x85d16a3 in pe_ILF_object_p
/home/hjy/Desktop/binutils-2.29/bfd/peicode.h:1261
#9 0x85d16a3 in pe_bfd_object_p
/home/hjy/Desktop/binutils-2.29/bfd/peicode.h:1408
#10 0x82bd375 in bfd_check_format_matches
/home/hjy/Desktop/binutils-2.29/bfd/format.c:311
#11 0x806e0e1 in display_object_bfd objdump.c:3601
#12 0x806e0e1 in display_any_bfd objdump.c:3692
#13 0x805837d in display_file objdump.c:3713
#14 0x805837d in main objdump.c:4015
#15 0xb7034a82 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x19a82)
#16 0x805af8f (/usr/local/bin/objdump+0x805af8f)

--- Comment #5 from Zhihua Yao <499671216 at qq dot com> ---
==8747==AddressSanitizer CHECK failed:
../../../../src/libsanitizer/sanitizer_common/sanitizer_posix.cc:66 "(("unable
to mmap" && 0)) != (0)" (0x0, 0x0)
#0 0xb72244c1 (/usr/lib/i386-linux-gnu/libasan.so.1+0x544c1)
#1 0xb72286a9 in __sanitizer::CheckFailed(char const*, int, char const*,
unsigned long long, unsigned long long)
(/usr/lib/i386-linux-gnu/libasan.so.1+0x586a9)
#2 0xb722de22 (/usr/lib/i386-linux-gnu/libasan.so.1+0x5de22)
#3 0xb71e899b (/usr/lib/i386-linux-gnu/libasan.so.1+0x1899b)
#4 0xb71e9488 (/usr/lib/i386-linux-gnu/libasan.so.1+0x19488)
#5 0xb721e84a in __interceptor_malloc
(/usr/lib/i386-linux-gnu/libasan.so.1+0x4e84a)
#6 0x8877f98 in _objalloc_alloc objalloc.c:143
#7 0x82d9bc5 in bfd_alloc /home/hjy/Desktop/binutils-2.29/bfd/opncls.c:958
#8 0x85d16a3 in pe_ILF_object_p
/home/hjy/Desktop/binutils-2.29/bfd/peicode.h:1261
#9 0x85d16a3 in pe_bfd_object_p
/home/hjy/Desktop/binutils-2.29/bfd/peicode.h:1408
#10 0x82bd375 in bfd_check_format_matches
/home/hjy/Desktop/binutils-2.29/bfd/format.c:311
#11 0x806e0e1 in display_object_bfd objdump.c:3601
#12 0x806e0e1 in display_any_bfd objdump.c:3692
#13 0x805837d in display_file objdump.c:3713
#14 0x805837d in main objdump.c:4015
#15 0xb7034a82 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x19a82)
#16 0x805af8f (/usr/local/bin/objdump+0x805af8f)

[499671216 at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=21929

--- Comment #6 from Zhihua Yao <499671216 at qq dot com> ---
Created attachment 10329
--> https://sourceware.org/bugzilla/attachment.cgi?id=10329&action=edit
oom-objdump4

[499671216 at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=21929

--- Comment #7 from Zhihua Yao <499671216 at qq dot com> ---
==6728==AddressSanitizer CHECK failed:
../../../../src/libsanitizer/sanitizer_common/sanitizer_posix.cc:66 "(("unable
to mmap" && 0)) != (0)" (0x0, 0x0)
#0 0xb728a4c1 (/usr/lib/i386-linux-gnu/libasan.so.1+0x544c1)
#1 0xb728e6a9 in __sanitizer::CheckFailed(char const*, int, char const*,
unsigned long long, unsigned long long)
(/usr/lib/i386-linux-gnu/libasan.so.1+0x586a9)
#2 0xb7293e22 (/usr/lib/i386-linux-gnu/libasan.so.1+0x5de22)
#3 0xb724e99b (/usr/lib/i386-linux-gnu/libasan.so.1+0x1899b)
#4 0xb724f488 (/usr/lib/i386-linux-gnu/libasan.so.1+0x19488)
#5 0xb728484a in __interceptor_malloc
(/usr/lib/i386-linux-gnu/libasan.so.1+0x4e84a)
#6 0x8877f98 in _objalloc_alloc objalloc.c:143
#7 0x82d9bc5 in bfd_alloc /home/hjy/Desktop/binutils-2.29/bfd/opncls.c:958
#8 0x839c2e5 in bfd_elf_get_str_section
/home/hjy/Desktop/binutils-2.29/bfd/elf.c:301
#9 0x839c2e5 in bfd_elf_string_from_elf_section
/home/hjy/Desktop/binutils-2.29/bfd/elf.c:348
#10 0x83b194f in bfd_elf_string_from_elf_section
/home/hjy/Desktop/binutils-2.29/bfd/elf.c:2182
#11 0x83b194f in bfd_section_from_shdr
/home/hjy/Desktop/binutils-2.29/bfd/elf.c:2007
#12 0x83872d0 in bfd_elf32_object_p
/home/hjy/Desktop/binutils-2.29/bfd/elfcode.h:805
#13 0x82bd375 in bfd_check_format_matches
/home/hjy/Desktop/binutils-2.29/bfd/format.c:311
#14 0x806e0e1 in display_object_bfd objdump.c:3601
#15 0x806e0e1 in display_any_bfd objdump.c:3692
#16 0x805837d in display_file objdump.c:3713
#17 0x805837d in main objdump.c:4015
#18 0xb709aa82 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x19a82)
#19 0x805af8f (/usr/local/bin/objdump+0x805af8f)

[amodra at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=21929

Alan Modra <amodra at gmail dot com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Priority|P2 |P3
CC| |amodra at gmail dot com
Severity|critical |enhancement

--- Comment #8 from Alan Modra <amodra at gmail dot com> ---
Out of memory on fuzzed files is not a serious problem.

[amodra at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=21929

Alan Modra <amodra at gmail dot com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |RESOLVED
Resolution|--- |WONTFIX

--- Comment #9 from Alan Modra <amodra at gmail dot com> ---
Closing, since it isn't a good idea to try to catch nonsense section sizes in
an object file. The problem is that comparing against file size isn't safe.
We have compressed and encoded sections that can expand well past the file
size.