[Bug binutils/23141] New: objcopy: SIGSEGV in bfd_elf_set_group_contents

[paolo.montesel+sourceware at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23141

Bug ID: 23141
Summary: objcopy: SIGSEGV in bfd_elf_set_group_contents
Product: binutils
Version: 2.31 (HEAD)
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: binutils
Assignee: unassigned at sourceware dot org
Reporter: paolo.montesel+sourceware at gmail dot com
Target Milestone: ---

Created attachment 10991
--> https://sourceware.org/bugzilla/attachment.cgi?id=10991&action=edit
objcopy crash

As part of a tool I'm writing I fuzzed binutils. The attached file makes
objcopy crash inside `bfd_elf_set_group_contents`:

Program received signal SIGSEGV, Segmentation fault.
0x000000000043bc33 in bfd_elf_set_group_contents (abfd=0x7322e0, sec=0x738f20,
failedptrarg=0x7fffffffd83c) at elf.c:3462
3462 symindx = elf_section_syms (abfd)[sec->index]->udata.i;
#0 0x000000000043bc33 in bfd_elf_set_group_contents (abfd=0x7322e0,
sec=0x738f20, failedptrarg=0x7fffffffd83c) at elf.c:3462
#1 0x000000000042639c in bfd_map_over_sections (abfd=***@entry=0x7322e0,
operation=***@entry=0x43b9e0 <bfd_elf_set_group_contents>,
user_storage=***@entry=0x7fffffffd83c) at section.c:1391
#2 0x0000000000443807 in _bfd_elf_compute_section_file_positions
(abfd=<optimized out>, link_info=***@entry=0x0) at elf.c:4250
#3 0x0000000000448f6c in _bfd_elf_set_section_contents (abfd=0x7322e0,
section=0x738df0, location=0x734620, offset=0, count=19) at elf.c:8854
#4 0x00000000004264f4 in bfd_set_section_contents (abfd=***@entry=0x7322e0,
section=***@entry=0x738df0, location=0x734620, offset=***@entry=0,
count=<optimized out>) at section.c:1529
#5 0x00000000004070f3 in copy_section (ibfd=<optimized out>,
isection=<optimized out>, obfdarg=0x7322e0) at objcopy.c:4108
#6 0x000000000042639c in bfd_map_over_sections (abfd=***@entry=0x72ef40,
operation=***@entry=0x406e20 <copy_section>,
user_storage=***@entry=0x7322e0) at section.c:1391
#7 0x0000000000408864 in copy_object (ibfd=<optimized out>, obfd=<optimized
out>, input_arch=<optimized out>) at objcopy.c:3057
#8 0x000000000040a63a in copy_file
(input_filename=***@entry=0x7fffffffe131 "id:000008,sig:1"...,
output_filename=***@entry=0x7fffffffe164 "/dev/null",
input_target=***@entry=0x0, output_target=<optimized out>,
***@entry=0x0, input_arch=***@entry=0x0) at objcopy.c:3532
#9 0x0000000000403334 in copy_main (argv=<optimized out>, argc=<optimized
out>) at objcopy.c:5484
#10 main (argc=***@entry=3, argv=***@entry=0x7fffffffdd88) at objcopy.c:5588
#11 0x00007ffff7829830 in __libc_start_main (main=0x402ea0 <main>, argc=3,
argv=0x7fffffffdd88, init=<optimized out>, fini=<optimized out>,
rtld_fini=<optimized out>, stack_end=0x7fffffffdd78) at ../csu/libc-start.c:291
#12 0x00000000004055c9 in _start ()

Compiled and tried against a freshly cloned repo. It also works on Ubuntu
Xenial's binutils (2.26.1).

[amodra at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23141

Alan Modra <amodra at gmail dot com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |ASSIGNED
Last reconfirmed| |2018-05-07
Assignee|unassigned at sourceware dot org |amodra at gmail dot com
Ever confirmed|0 |1