debug/elf: slice bounds out of range
dvyukov opened this issue · 6 comments
The following program crashes with the panic on the provided inputs:
package main
import (
"bytes"
"debug/elf"
"io/ioutil"
"os"
)
func main() {
data, _ := ioutil.ReadFile(os.Args[1])
f, err := elf.NewFile(bytes.NewReader(data))
if err != nil {
if f != nil {
panic("file is not nil on error")
}
return
}
defer f.Close()
f.DynamicSymbols()
f.ImportedLibraries()
f.ImportedSymbols()
f.Section(".data")
f.SectionByType(elf.SHT_GNU_VERSYM)
f.Symbols()
dw, err := f.DWARF()
if err != nil {
if dw != nil {
panic("dwarf is not nil on error")
}
return
}
dr := dw.Reader()
for {
e, _ := dr.Next()
if e == nil {
break
}
}
}On input https://drive.google.com/file/d/0B20Uwp8Hs1oCQmk0YU1JaXM1N0E/view?usp=sharing
panic: runtime error: slice bounds out of range
goroutine 1 [running]:
debug/elf.(*File).DynString(0xc208076000, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0)
src/debug/elf/file.go:1053 +0x6ad
debug/elf.(*File).ImportedLibraries(0xc208076000, 0x0, 0x0, 0x0, 0x0, 0x0)
src/debug/elf/file.go:1015 +0x4e
main.main()
elftest.go:21 +0x1ec
On input https://drive.google.com/file/d/0B20Uwp8Hs1oCOXlsZGhXY2NhOW8/view?usp=sharing
panic: runtime error: index out of range
goroutine 1 [running]:
encoding/binary.(*littleEndian).Uint16(0x645be8, 0xc20800a954, 0x1, 0x1, 0xc208040003)
<autogenerated>:8 +0xc9
debug/elf.(*File).gnuVersion(0xc208076000, 0x14, 0xc2080800f0)
src/debug/elf/file.go:1002 +0xb8
debug/elf.(*File).ImportedSymbols(0xc208076000, 0x0, 0x0, 0x0, 0x0, 0x0)
src/debug/elf/file.go:914 +0x348
main.main()
elftest.go:22 +0x1fa
on commit 596bb76
It's too late in the Go 1.5 release process for fuzzer bugs. The chance of hitting any of these is so low that the benefit of the fix is outweighed by the chance of the fix introducing a more serious bug.
@dvyukov do you still have those files? The links no longer work.
No, I don't have them now. But running go-fuzz on the package is likely to re-reproduce it (good idea anyway b/c there are likely more bugs after this one). The fuzzer probably needs to be seeded with some real ELF binaries.
Note that there has been a lot of fuzzing work on debug/elf since this bug was opened in 2015: https://github.com/golang/go/issues?q=is%3Aissue+author%3Acatenacyber+debug%2Felf
See also #47653 .