Bug 1262839 - [abrt] [faf] elfutils: _IO_default_xsputn(): /usr/bin/eu-readelf killed by 11
[abrt] [faf] elfutils: _IO_default_xsputn(): /usr/bin/eu-readelf killed by 11
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: elfutils (Show other bugs)
7.2
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Mark Wielaard
Martin Cermak
https://retrace.fedoraproject.org/faf...
:
Depends On: 1259259
Blocks:
  Show dependency treegraph
 
Reported: 2015-09-14 09:13 EDT by Mark Wielaard
Modified: 2015-11-19 05:19 EST (History)
8 users (show)

See Also:
Fixed In Version: elfutils-0.163-3.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 1259259
Environment:
Last Closed: 2015-11-19 05:19:56 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Mark Wielaard 2015-09-14 09:13:11 EDT
+++ This bug was initially created as a clone of Bug #1259259 +++

This bug has been created based on an anonymous crash report requested by the package maintainer.

Report URL: https://retrace.fedoraproject.org/faf/reports/bthash/83028d435e044f87ca420370b79a45fffccde96c/

--- Additional comment from Mark Wielaard on 2015-09-02 06:07:39 EDT ---

This issue is this code in readelf.c (handle_core_item):

      {
        char printed[(negate ? nbits - pop : pop) * 16];
        char *p = printed;
        *p = '\0';

[...]

            unsigned int bit = ((void *) i - data) * 8;
            unsigned int w = negate ? ~*i : *i;
            while (w != 0)
              {
                int n = ffs (w);
                w >>= n;
                bit += n;

                if (lastbit != 0 && lastbit + 1 == bit)
                  ++run;
                else
                  {
                    if (lastbit == 0)
                      p += sprintf (p, "%u", bit - bias);
                    else if (run == 0)
                      p += sprintf (p, ",%u", bit - bias);
                    else
                      p += sprintf (p, "-%u,%u", lastbit - bias, bit - bias);
                    run = 0;
                  }

                lastbit = bit;
              }

One of the sprintf calls will overflow the p char array.

--- Additional comment from Mark Wielaard on 2015-09-03 04:12:54 EDT ---

The problem is this:

  int n = ffs (w);
  w >>= n;

The intent is to shift away up to (and including) the first least significant bit in w. But w is a unsigned int, so 32 bits. And the least significant bit could be bit 32 (ffs counts from 1). Unfortunately a right shift equal to (or larger than) the length in bits of the left hand operand is undefined behaviour. We expect w to be zero afterwards. Which would terminate the while loop. But since it is undefined behaviour anything can happen. In this case, what will happen is that w is unchanged, causing an infinite loop...

gcc -fsanitize=undefined will catch and warn about this when w = 0x80000000

--- Additional comment from Mark Wielaard on 2015-09-03 06:47:36 EDT ---

Upstream patch:
https://lists.fedorahosted.org/pipermail/elfutils-devel/2015-September/005118.html

--- Additional comment from Fedora Update System on 2015-09-07 07:29:11 EDT ---

elfutils-0.163-4.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-15264

--- Additional comment from Fedora Update System on 2015-09-07 14:20:19 EDT ---

elfutils-0.163-4.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update elfutils'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-15264

--- Additional comment from Fedora Update System on 2015-09-07 21:21:45 EDT ---

elfutils-0.163-4.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 5 errata-xmlrpc 2015-11-19 05:19:56 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2015-2126.html

Note You need to log in before you can comment on or make changes to this bug.