Bug 1259259 - [abrt] [faf] elfutils: _IO_default_xsputn(): /usr/bin/eu-readelf killed by 11
Summary: [abrt] [faf] elfutils: _IO_default_xsputn(): /usr/bin/eu-readelf killed by 11
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: elfutils
Version: 22
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Mark Wielaard
QA Contact: Fedora Extras Quality Assurance
URL: https://retrace.fedoraproject.org/faf...
Whiteboard:
Depends On:
Blocks: 1262839
TreeView+ depends on / blocked
 
Reported: 2015-09-02 10:01 UTC by Mark Wielaard
Modified: 2015-12-09 16:35 UTC (History)
9 users (show)

Fixed In Version: 0.163-4.fc23 elfutils-0.163-4.fc22 elfutils-0.163-4.fc21
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1262839 (view as bug list)
Environment:
Last Closed: 2015-10-23 17:24:21 UTC


Attachments (Terms of Use)

Description Mark Wielaard 2015-09-02 10:01:58 UTC
This bug has been created based on an anonymous crash report requested by the package maintainer.

Report URL: https://retrace.fedoraproject.org/faf/reports/bthash/83028d435e044f87ca420370b79a45fffccde96c/

Comment 1 Mark Wielaard 2015-09-02 10:07:39 UTC
This issue is this code in readelf.c (handle_core_item):

      {
        char printed[(negate ? nbits - pop : pop) * 16];
        char *p = printed;
        *p = '\0';

[...]

            unsigned int bit = ((void *) i - data) * 8;
            unsigned int w = negate ? ~*i : *i;
            while (w != 0)
              {
                int n = ffs (w);
                w >>= n;
                bit += n;

                if (lastbit != 0 && lastbit + 1 == bit)
                  ++run;
                else
                  {
                    if (lastbit == 0)
                      p += sprintf (p, "%u", bit - bias);
                    else if (run == 0)
                      p += sprintf (p, ",%u", bit - bias);
                    else
                      p += sprintf (p, "-%u,%u", lastbit - bias, bit - bias);
                    run = 0;
                  }

                lastbit = bit;
              }

One of the sprintf calls will overflow the p char array.

Comment 2 Mark Wielaard 2015-09-03 08:12:54 UTC
The problem is this:

  int n = ffs (w);
  w >>= n;

The intent is to shift away up to (and including) the first least significant bit in w. But w is a unsigned int, so 32 bits. And the least significant bit could be bit 32 (ffs counts from 1). Unfortunately a right shift equal to (or larger than) the length in bits of the left hand operand is undefined behaviour. We expect w to be zero afterwards. Which would terminate the while loop. But since it is undefined behaviour anything can happen. In this case, what will happen is that w is unchanged, causing an infinite loop...

gcc -fsanitize=undefined will catch and warn about this when w = 0x80000000

Comment 4 Fedora Update System 2015-09-07 11:29:11 UTC
elfutils-0.163-4.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-15264

Comment 5 Fedora Update System 2015-09-07 18:20:19 UTC
elfutils-0.163-4.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update elfutils'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-15264

Comment 6 Fedora Update System 2015-09-08 01:21:45 UTC
elfutils-0.163-4.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2015-10-09 09:26:58 UTC
elfutils-0.163-4.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-ba9ded92ef

Comment 8 Fedora Update System 2015-10-09 09:28:00 UTC
elfutils-0.163-4.fc21 has been submitted as an update to Fedora 21. https://bodhi.fedoraproject.org/updates/FEDORA-2015-aabc904fe3

Comment 9 Fedora Update System 2015-10-09 23:22:42 UTC
elfutils-0.163-4.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update elfutils'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-ba9ded92ef

Comment 10 Fedora Update System 2015-10-10 16:49:39 UTC
elfutils-0.163-4.fc21 has been pushed to the Fedora 21 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update elfutils'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-aabc904fe3

Comment 11 Fedora Update System 2015-10-23 17:24:14 UTC
elfutils-0.163-4.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2015-10-28 16:20:04 UTC
elfutils-0.163-4.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.