Bug 1259259
| Summary: | [abrt] [faf] elfutils: _IO_default_xsputn(): /usr/bin/eu-readelf killed by 11 | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Mark Wielaard <mjw> | |
| Component: | elfutils | Assignee: | Mark Wielaard <mjw> | |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 22 | CC: | aoliva, fche, jakub, jan.kratochvil, me, mjw, obliterator666, roland, spichka21 | |
| Target Milestone: | --- | Keywords: | Reopened | |
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| URL: | https://retrace.fedoraproject.org/faf/reports/bthash/83028d435e044f87ca420370b79a45fffccde96c/ | |||
| Whiteboard: | ||||
| Fixed In Version: | 0.163-4.fc23 elfutils-0.163-4.fc22 elfutils-0.163-4.fc21 | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1262839 (view as bug list) | Environment: | ||
| Last Closed: | 2015-10-23 17:24:21 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1262839 | |||
|
Description
Mark Wielaard
2015-09-02 10:01:58 UTC
This issue is this code in readelf.c (handle_core_item):
{
char printed[(negate ? nbits - pop : pop) * 16];
char *p = printed;
*p = '\0';
[...]
unsigned int bit = ((void *) i - data) * 8;
unsigned int w = negate ? ~*i : *i;
while (w != 0)
{
int n = ffs (w);
w >>= n;
bit += n;
if (lastbit != 0 && lastbit + 1 == bit)
++run;
else
{
if (lastbit == 0)
p += sprintf (p, "%u", bit - bias);
else if (run == 0)
p += sprintf (p, ",%u", bit - bias);
else
p += sprintf (p, "-%u,%u", lastbit - bias, bit - bias);
run = 0;
}
lastbit = bit;
}
One of the sprintf calls will overflow the p char array.
The problem is this: int n = ffs (w); w >>= n; The intent is to shift away up to (and including) the first least significant bit in w. But w is a unsigned int, so 32 bits. And the least significant bit could be bit 32 (ffs counts from 1). Unfortunately a right shift equal to (or larger than) the length in bits of the left hand operand is undefined behaviour. We expect w to be zero afterwards. Which would terminate the while loop. But since it is undefined behaviour anything can happen. In this case, what will happen is that w is unchanged, causing an infinite loop... gcc -fsanitize=undefined will catch and warn about this when w = 0x80000000 elfutils-0.163-4.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-15264 elfutils-0.163-4.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update elfutils'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-15264 elfutils-0.163-4.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report. elfutils-0.163-4.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-ba9ded92ef elfutils-0.163-4.fc21 has been submitted as an update to Fedora 21. https://bodhi.fedoraproject.org/updates/FEDORA-2015-aabc904fe3 elfutils-0.163-4.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'dnf --enablerepo=updates-testing update elfutils' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-ba9ded92ef elfutils-0.163-4.fc21 has been pushed to the Fedora 21 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'dnf --enablerepo=updates-testing update elfutils' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-aabc904fe3 elfutils-0.163-4.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report. elfutils-0.163-4.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. |