Use-after-free in make_qualified_name

```
==1365452==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020000000b0 at pc 0x0000004b9c56 bp 0x7ffd174f32d0 sp 0x7ffd174f2a90
READ of size 2 at 0x6020000000b0 thread T0
    #0 0x4b9c55 in strlen /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:372:5
    #1 0x6017c1 in make_qualified_name /src/binutils-gdb/binutils/elfcomm.c
    #2 0x5643f6 in process_archive /src/binutils-gdb/binutils/./readelf.h:20306:24
    #3 0x558b80 in process_file /src/binutils-gdb/binutils/./readelf.h:20468:14
    #4 0x558fc2 in LLVMFuzzerTestOneInput /src/binutils-gdb/binutils/fuzz_readelf.c:53:2
    #5 0x45bb53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:599:15
    #6 0x4472c2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6
    #7 0x44cf66 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:856:9
    #8 0x476472 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #9 0x7efde0319b26 in __libc_start_main (/lib64/libc.so.6+0x25b26)
    #10 0x423179 in _start (/root/oss-fuzz/build/out/binutils/fuzz_readelf+0x423179)

DEDUP_TOKEN: strlen--make_qualified_name--process_archive
0x6020000000b0 is located 0 bytes inside of 7-byte region [0x6020000000b0,0x6020000000b7)
freed by thread T0 here:
    #0 0x522612 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:127:3
    #1 0x600ac8 in release_archive /src/binutils-gdb/binutils/elfcomm.c:740:5
    #2 0x600a1f in setup_nested_archive /src/binutils-gdb/binutils/elfcomm.c:725:3
    #3 0x6012ca in get_archive_member_name /src/binutils-gdb/binutils/elfcomm.c:814:14
    #4 0x5643d0 in process_archive /src/binutils-gdb/binutils/./readelf.h:20297:14
    #5 0x558b80 in process_file /src/binutils-gdb/binutils/./readelf.h:20468:14
    #6 0x558fc2 in LLVMFuzzerTestOneInput /src/binutils-gdb/binutils/fuzz_readelf.c:53:2
    #7 0x45bb53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:599:15
    #8 0x4472c2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6
    #9 0x44cf66 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:856:9
    #10 0x476472 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #11 0x7efde0319b26 in __libc_start_main (/lib64/libc.so.6+0x25b26)

DEDUP_TOKEN: free--release_archive--setup_nested_archive
previously allocated by thread T0 here:
    #0 0x50e164 in strdup /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:452:3
    #1 0x5ff9ef in setup_archive /src/binutils-gdb/binutils/elfcomm.c:615:21
    #2 0x600a4b in setup_nested_archive /src/binutils-gdb/binutils/elfcomm.c:730:10
    #3 0x6012ca in get_archive_member_name /src/binutils-gdb/binutils/elfcomm.c:814:14
    #4 0x5643d0 in process_archive /src/binutils-gdb/binutils/./readelf.h:20297:14
    #5 0x558b80 in process_file /src/binutils-gdb/binutils/./readelf.h:20468:14
    #6 0x558fc2 in LLVMFuzzerTestOneInput /src/binutils-gdb/binutils/fuzz_readelf.c:53:2
    #7 0x45bb53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:599:15
    #8 0x4472c2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6
    #9 0x44cf66 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:856:9
    #10 0x476472 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #11 0x7efde0319b26 in __libc_start_main (/lib64/libc.so.6+0x25b26)

DEDUP_TOKEN: strdup--setup_archive--setup_nested_archive
SUMMARY: AddressSanitizer: heap-use-after-free /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:372:5 in strlen
Shadow bytes around the buggy address:
  0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff8000: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa
=>0x0c047fff8010: fa fa fd fa fa fa[fd]fa fa fa fd fa fa fa 00 07
  0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1365452==ABORTING
```

src-openEuler/binutils

内容风险标识

评论 (3)

src-openEuler/binutils .gitee-modal { width: 500px !important; }

内容风险标识