Created attachment 1245457 [details] Patch containing buffer overflow correction Description of problem: *** buffer overflow detected ***: /bin/ld terminated ======= Backtrace: ========= /usr/lib64/libc.so.6(+0x791fb)[0x7ffff75401fb] /usr/lib64/libc.so.6(__fortify_fail+0x37)[0x7ffff75e1187] /usr/lib64/libc.so.6(+0x118120)[0x7ffff75df120] /usr/lib64/libc.so.6(+0x1176d9)[0x7ffff75de6d9] /usr/lib64/libc.so.6(_IO_default_xsputn+0xa9)[0x7ffff7544b39] /usr/lib64/libc.so.6(_IO_vfprintf+0x106)[0x7ffff7514b06] /usr/lib64/libc.so.6(__vsprintf_chk+0x8c)[0x7ffff75de76c] /usr/lib64/libc.so.6(__sprintf_chk+0x7d)[0x7ffff75de6bd] /bin/ld(+0x20cf1)[0x555555574cf1] /usr/src/debug/binutils-2.26.1/ld/./ldmain.c:836 /bin/ld(+0x1a8b4)[0x55555556e8b4] /usr/src/debug/binutils-2.26.1/ld/ldlang.c:2867 /bin/ld(+0x1b495)[0x55555556f495] /usr/src/debug/binutils-2.26.1/ld/ldlang.c:3345 /bin/ld(+0x1d8ea)[0x5555555718ea] /usr/src/debug/binutils-2.26.1/ld/ldlang.c:6749 /bin/ld(+0xb2ee)[0x55555555f2ee] /usr/src/debug/binutils-2.26.1/ld/./ldmain.c:394 /usr/lib64/libc.so.6(__libc_start_main+0xf1)[0x7ffff74e7401] /bin/ld(+0xb87a)[0x55555555f87a] ======= Memory map: ======== 555555554000-55555564a000 r-xp 00000000 00:3e 19328 /usr/bin/ld.bfd 555555849000-55555584e000 r--p 000f5000 00:3e 19328 /usr/bin/ld.bfd 55555584e000-555555850000 rw-p 000fa000 00:3e 19328 /usr/bin/ld.bfd 555555850000-5555558bb000 rw-p 00000000 00:00 0 [heap] 7ffff709f000-7ffff70b5000 r-xp 00000000 00:3e 6094 /usr/lib64/libgcc_s-6.3.1-20161221.so.1 7ffff70b5000-7ffff72b4000 ---p 00016000 00:3e 6094 /usr/lib64/libgcc_s-6.3.1-20161221.so.1 7ffff72b4000-7ffff72b5000 r--p 00015000 00:3e 6094 /usr/lib64/libgcc_s-6.3.1-20161221.so.1 7ffff72b5000-7ffff72b6000 rw-p 00016000 00:3e 6094 /usr/lib64/libgcc_s-6.3.1-20161221.so.1 7ffff72b6000-7ffff72c6000 r-xp 00000000 00:3e 20993 /usr/libexec/gcc/x86_64-redhat-linux/6.3.1/liblto_plugin.so.0.0.0 7ffff72c6000-7ffff74c5000 ---p 00010000 00:3e 20993 /usr/libexec/gcc/x86_64-redhat-linux/6.3.1/liblto_plugin.so.0.0.0 7ffff74c5000-7ffff74c6000 r--p 0000f000 00:3e 20993 /usr/libexec/gcc/x86_64-redhat-linux/6.3.1/liblto_plugin.so.0.0.0 7ffff74c6000-7ffff74c7000 rw-p 00010000 00:3e 20993 /usr/libexec/gcc/x86_64-redhat-linux/6.3.1/liblto_plugin.so.0.0.0 7ffff74c7000-7ffff7684000 r-xp 00000000 00:3e 3564 /usr/lib64/libc-2.24.so 7ffff7684000-7ffff7883000 ---p 001bd000 00:3e 3564 /usr/lib64/libc-2.24.so 7ffff7883000-7ffff7887000 r--p 001bc000 00:3e 3564 /usr/lib64/libc-2.24.so 7ffff7887000-7ffff7889000 rw-p 001c0000 00:3e 3564 /usr/lib64/libc-2.24.so 7ffff7889000-7ffff788d000 rw-p 00000000 00:00 0 7ffff788d000-7ffff7890000 r-xp 00000000 00:3e 3568 /usr/lib64/libdl-2.24.so 7ffff7890000-7ffff7a8f000 ---p 00003000 00:3e 3568 /usr/lib64/libdl-2.24.so 7ffff7a8f000-7ffff7a90000 r--p 00002000 00:3e 3568 /usr/lib64/libdl-2.24.so 7ffff7a90000-7ffff7a91000 rw-p 00003000 00:3e 3568 /usr/lib64/libdl-2.24.so 7ffff7a91000-7ffff7bb9000 r-xp 00000000 00:3e 19338 /usr/lib64/libbfd-2.26.1-1.fc25.so 7ffff7bb9000-7ffff7db9000 ---p 00128000 00:3e 19338 /usr/lib64/libbfd-2.26.1-1.fc25.so 7ffff7db9000-7ffff7dcd000 r--p 00128000 00:3e 19338 /usr/lib64/libbfd-2.26.1-1.fc25.so 7ffff7dcd000-7ffff7dd2000 rw-p 0013c000 00:3e 19338 /usr/lib64/libbfd-2.26.1-1.fc25.so 7ffff7dd2000-7ffff7dd7000 rw-p 00000000 00:00 0 7ffff7dd7000-7ffff7dfc000 r-xp 00000000 00:3e 3557 /usr/lib64/ld-2.24.so 7ffff7f87000-7ffff7f88000 rw-p 00000000 00:00 0 7ffff7f88000-7ffff7f9b000 r--p 00000000 00:3e 19348 /usr/share/locale/bg/LC_MESSAGES/ld.mo 7ffff7f9b000-7ffff7fec000 r--p 00000000 00:3e 56999 /usr/lib/locale/bg_BG.utf8/LC_CTYPE 7ffff7fec000-7ffff7ff3000 r--s 00000000 00:3e 3869 /usr/lib64/gconv/gconv-modules.cache 7ffff7ff3000-7ffff7ff4000 r--p 00000000 00:3e 57003 /usr/lib/locale/bg_BG.utf8/LC_MESSAGES/SYS_LC_MESSAGES 7ffff7ff4000-7ffff7ff8000 rw-p 00000000 00:00 0 7ffff7ff8000-7ffff7ffa000 r--p 00000000 00:00 0 [vvar] 7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso] 7ffff7ffc000-7ffff7ffd000 r--p 00025000 00:3e 3557 /usr/lib64/ld-2.24.so 7ffff7ffd000-7ffff7ffe000 rw-p 00026000 00:3e 3557 /usr/lib64/ld-2.24.so 7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0 7ffffffdd000-7ffffffff000 rw-p 00000000 00:00 0 [stack] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] Version-Release number of selected component (if applicable): binutils-2.26.1-1.fc25.x86_64 binutils-debuginfo-2.26.1-1.fc25.x86_64 How reproducible: Default language settings must be different from English - for example Cyrillic (bg_BG.utf8, ...) Additional info: I found two similar buffer overflow in the files "ld/ldmain.c:836" and "ld/ldlang.c:2035" -------------------- (gdb) list /usr/src/debug/binutils-2.26.1/ld/./ldmain.c:836 831 { 832 char buf[100]; 833 834 b.overflow-> sprintf (buf, _("Archive member included " 835 "to satisfy reference by file (symbol)\n\n")); 836 minfo ("%s", buf); 837 header_printed = TRUE; 838 } 839 840 if (bfd_my_archive (abfd) == NULL) (gdb) ----- ld/ldlang.c --- 2030 char buf[100]; ... 2035 b.overflow-> sprintf (buf, _("\nAs-needed library included " 2036 "to satisfy reference by file (symbol)\n\n")); 2037 minfo ("%s", buf); I found the same problem in other versions of binutils.
Hi Dimitar, > I found two similar buffer overflow in the files "ld/ldmain.c:836" and > "ld/ldlang.c:2035" Thanks for reporting these two bugs. I have added a patch to the rawhide binutils rpm to fix the problem, and I will checking in a similar patch to the FSF binutils shortly. Cheers Nick PS. The fix should be in: binutils-2.27-15.fc26
This message is a reminder that Fedora 25 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 25. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '25'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 25 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Fedora 25 changed to end-of-life (EOL) status on 2017-12-12. Fedora 25 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.