Bug 1262839

+++ This bug was initially created as a clone of Bug #1259259 +++

This bug has been created based on an anonymous crash report requested by the package maintainer.

Report URL: https://retrace.fedoraproject.org/faf/reports/bthash/83028d435e044f87ca420370b79a45fffccde96c/

--- Additional comment from Mark Wielaard on 2015-09-02 06:07:39 EDT ---

This issue is this code in readelf.c (handle_core_item):

      {
        char printed[(negate ? nbits - pop : pop) * 16];
        char *p = printed;
        *p = '\0';

[...]

            unsigned int bit = ((void *) i - data) * 8;
            unsigned int w = negate ? ~*i : *i;
            while (w != 0)
              {
                int n = ffs (w);
                w >>= n;
                bit += n;

                if (lastbit != 0 && lastbit + 1 == bit)
                  ++run;
                else
                  {
                    if (lastbit == 0)
                      p += sprintf (p, "%u", bit - bias);
                    else if (run == 0)
                      p += sprintf (p, ",%u", bit - bias);
                    else
                      p += sprintf (p, "-%u,%u", lastbit - bias, bit - bias);
                    run = 0;
                  }

                lastbit = bit;
              }

One of the sprintf calls will overflow the p char array.

--- Additional comment from Mark Wielaard on 2015-09-03 04:12:54 EDT ---

The problem is this:

  int n = ffs (w);
  w >>= n;

The intent is to shift away up to (and including) the first least significant bit in w. But w is a unsigned int, so 32 bits. And the least significant bit could be bit 32 (ffs counts from 1). Unfortunately a right shift equal to (or larger than) the length in bits of the left hand operand is undefined behaviour. We expect w to be zero afterwards. Which would terminate the while loop. But since it is undefined behaviour anything can happen. In this case, what will happen is that w is unchanged, causing an infinite loop...

gcc -fsanitize=undefined will catch and warn about this when w = 0x80000000

--- Additional comment from Mark Wielaard on 2015-09-03 06:47:36 EDT ---

Upstream patch:
https://lists.fedorahosted.org/pipermail/elfutils-devel/2015-September/005118.html

--- Additional comment from Fedora Update System on 2015-09-07 07:29:11 EDT ---

elfutils-0.163-4.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-15264

--- Additional comment from Fedora Update System on 2015-09-07 14:20:19 EDT ---

elfutils-0.163-4.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update elfutils'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-15264

--- Additional comment from Fedora Update System on 2015-09-07 21:21:45 EDT ---

elfutils-0.163-4.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.