Heap-buffer-overflow in retdec-fileinfo at elfio_symbols.hpp:249
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
We are currently working on fuzz testing feature, and we found a crash on `retdec-fileinfo`.
The stack traces are as follow:
```st
==622==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000013440 at pc 0x56264f24eb37 bp 0x7ffe841966e0 sp 0x7ffe841966d0
READ of size 8 at 0x606000013440 thread T0
#0 0x56264f24eb36 in bool ELFIO::symbol_section_accessor::generic_get_symbol(unsigned long, std::__cxx11::basic_string, std::allocator >&, unsigned long&, unsigned long&, unsigned char&, unsigned char&, unsigned short&, unsigned char&) const .../retdec-git/deps/elfio/include/elfio/elfio_symbols.hpp:249
#1 0x56264f24eb36 in ELFIO::symbol_section_accessor::get_symbol(unsigned long, std::__cxx11::basic_string, std::allocator >&, unsigned long&, unsigned long&, unsigned char&, unsigned char&, unsigned short&, unsigned char&) const .../retdec-git/deps/elfio/include/elfio/elfio_symbols.hpp:82
#2 0x56264f7a93a3 in retdec::fileformat::ElfFormat::loadSymbols(ELFIO::elfio const*, ELFIO::symbol_section_accessor const*, ELFIO::section const*) .../retdec-git/src/fileformat/file_format/elf/elf_format.cpp:1750
#3 0x56264f7b114f in retdec::fileformat::ElfFormat::loadSections() .../retdec-git/src/fileformat/file_format/elf/elf_format.cpp:2053
#4 0x56264f7b3487 in retdec::fileformat::ElfFormat::initStructures() .../retdec-git/src/fileformat/file_format/elf/elf_format.cpp:1131
#5 0x56264f7b3d4b in retdec::fileformat::ElfFormat::ElfFormat(std::__cxx11::basic_string, std::allocator >, retdec::fileformat::LoadFlags) .../retdec-git/src/fileformat/file_format/elf/elf_format.cpp:1093
#6 0x56264f4acb1a in retdec::fileinfo::ElfWrapper::ElfWrapper(std::__cxx11::basic_string, std::allocator >, retdec::fileformat::LoadFlags) .../retdec-git/src/fileinfo/file_wrapper/elf_wrapper.cpp:19
#7 0x56264f23fc26 in void __gnu_cxx::new_allocator::construct, std::allocator >, retdec::fileformat::LoadFlags&>(retdec::fileinfo::ElfWrapper*, std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/ext/new_allocator.h:136
#8 0x56264f23fc26 in void std::allocator_traits >::construct, std::allocator >, retdec::fileformat::LoadFlags&>(std::allocator&, retdec::fileinfo::ElfWrapper*, std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/bits/alloc_traits.h:475
#9 0x56264f23fc26 in std::_Sp_counted_ptr_inplace, (__gnu_cxx::_Lock_policy)2>::_Sp_counted_ptr_inplace, std::allocator >, retdec::fileformat::LoadFlags&>(std::allocator, std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/bits/shared_ptr_base.h:526
#10 0x56264f23fc26 in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count, std::__cxx11::basic_string, std::allocator >, retdec::fileformat::LoadFlags&>(std::_Sp_make_shared_tag, retdec::fileinfo::ElfWrapper*, std::allocator const&, std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/bits/shared_ptr_base.h:637
#11 0x56264f23fc26 in std::__shared_ptr::__shared_ptr, std::__cxx11::basic_string, std::allocator >, retdec::fileformat::LoadFlags&>(std::_Sp_make_shared_tag, std::allocator const&, std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/bits/shared_ptr_base.h:1295
#12 0x56264f23fc26 in std::shared_ptr::shared_ptr, std::__cxx11::basic_string, std::allocator >, retdec::fileformat::LoadFlags&>(std::_Sp_make_shared_tag, std::allocator const&, std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/bits/shared_ptr.h:344
#13 0x56264f23fc26 in std::shared_ptr std::allocate_shared, std::__cxx11::basic_string, std::allocator >, retdec::fileformat::LoadFlags&>(std::allocator const&, std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/bits/shared_ptr.h:691
#14 0x56264f23fc26 in std::shared_ptr std::make_shared, std::allocator >, retdec::fileformat::LoadFlags&>(std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/bits/shared_ptr.h:707
#15 0x56264f23fc26 in retdec::fileinfo::ElfDetector::ElfDetector(std::__cxx11::basic_string, std::allocator >, retdec::fileinfo::FileInformation&, retdec::cpdetect::DetectParams&, retdec::fileformat::LoadFlags) .../retdec-git/src/fileinfo/file_detector/elf_detector.cpp:782
#16 0x56264f22b42f in retdec::fileinfo::createFileDetector(std::__cxx11::basic_string, std::allocator > const&, std::__cxx11::basic_string, std::allocator > const&, retdec::fileformat::Format, retdec::fileinfo::FileInformation&, retdec::cpdetect::DetectParams&, retdec::fileformat::LoadFlags) .../retdec-git/src/fileinfo/file_detector/detector_factory.cpp:48
#17 0x56264f196482 in main .../retdec-git/src/fileinfo/fileinfo.cpp:788
```
Here is the full stack trace :
[stacktrace_retdec-fileinfo_1.zip](https://github.com/avast/retdec/files/7078367/stacktrace_retdec-fileinfo_1.zip)
**Step to reproduce**
We configured `retdec-fileinfo` using `CFLAGS="-g -O0 -fsanitize=address" CXXFLAGS="-g -O0 -fsanitize=address" cmake -DBUILD_SHARED_LIBS=OFF -DRETDEC_ENABLE_ALL=OFF -DRETDEC_ENABLE_FILEINFO=ON .. ` and built it using `make -j10; make install`, and run it with:
```
./retdec-fileinfo
```
Attachment:
[input_retdec-fileinfo_1.zip](https://github.com/avast/retdec/files/7078368/input_retdec-fileinfo_1.zip)
**Environment**
- OS: Ubuntu 18.04.5 LTS
- GCC version: gcc 7.5.0
- retdec version: latest commit of master branch on github ([link](https://github.com/avast/retdec/tree/e364c52dd07cf30d3e13820e84f3e11052ae4c03))
Thank you.
Contributor guide
No contributing guide indexed for this repository
Research direction
Build retdec-fileinfo with the shown AddressSanitizer flags and run it on input_retdec-fileinfo_1.zip. Start at deps/elfio/include/elfio/elfio_symbols.hpp:249 and follow the call into src/fileformat/file_format/elf/elf_format.cpp:1750. Done means the attached input no longer produces a heap-buffer-overflow under ASan, with regression coverage if the existing tests provide an appropriate entry point.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100