[Bug general/22976] New: global-buffer-overflow in ebl_dynamic_tag_name (libebl/ebldynamictagname.c)

["probefuzzer at gmail dot com" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=22976

            Bug ID: 22976
           Summary: global-buffer-overflow in ebl_dynamic_tag_name
                    (libebl/ebldynamictagname.c)
           Product: elfutils
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: general
          Assignee: unassigned at sourceware dot org
          Reporter: probefuzzer at gmail dot com
                CC: elfutils-devel at sourceware dot org
  Target Milestone: ---

Created attachment 10899
  --> https://sourceware.org/bugzilla/attachment.cgi?id=10899&action=edit
poc

On latest version (elfutils-0.170) and master branch of elfutils:
there is a global-buffer-overflow in ebl_dynamic_tag_name function of
(libebl/ebldynamictagname.c), which can be triggered by the POC below. 

To reproduce the issue, compile elfutils with asan and run: ./bin/eu-readelf -a
$POC

==13884==ERROR: AddressSanitizer: global-buffer-overflow on address
0x0000006c18d0 at pc 0x00000048e6b4 bp 0x7fffffffc5c0 sp 0x7fffffffc5b8
READ of size 8 at 0x0000006c18d0 thread T0
    #0 0x48e6b3 in ebl_dynamic_tag_name
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/libebl/ebldynamictagname.c:59
    #1 0x47602b in handle_dynamic
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/src/readelf.c:1708
    #2 0x47602b in print_dynamic
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/src/readelf.c:1813
    #3 0x47602b in process_elf_file
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/src/readelf.c:911
    #4 0x479fde in process_dwflmod
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/src/readelf.c:707
    #5 0x7fe8230dc22c in dwfl_getmodules
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/libdwfl/dwfl_getmodules.c:86
    #6 0x412568 in process_file
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/src/readelf.c:806
    #7 0x4059f3 in main
/u/xw48/GreedyFuzzing/product/elfutils/master-test/src/src/readelf.c:322
    #8 0x7fe8229b5c04 in __libc_start_main (/lib64/libc.so.6+0x21c04)
    #9 0x406493 
(/home/xw48/GreedyFuzzing/product/elfutils/master-test/exe_asan/bin/eu-readelf+0x406493)

-- 
You are receiving this mail because:
You are on the CC list for the bug.