[Bug binutils/25959] New: [nm] segmentation fault with at vms-alpha.c:1577

[dkcjd2000 at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=25959

            Bug ID: 25959
           Summary: [nm] segmentation fault with at vms-alpha.c:1577
           Product: binutils
           Version: 2.34
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: dkcjd2000 at gmail dot com
  Target Milestone: ---

Created attachment 12517
  --> https://sourceware.org/bugzilla/attachment.cgi?id=12517&action=edit
crash test case

Hello,
I'm currently developing a new fuzzing feature, and I found a crash in nm.

It crashed in dst_restore_location at vms-alpha.c:1577.

I built it with Ubuntu 16.04 with gcc 5.4.0, and the following command to build
nm from the source:
./configure --enable-targets=all ; make clean all -j 4; make install

You can reproduce the crash with the following command:
./nm <attached file>

The call stack of the crash is:
Program received signal SIGSEGV, Segmentation fault.
0x0000000000542303 in dst_restore_location (loc=436144132, abfd=0xb15290) at
vms-alpha.c:1577
1577      PRIV (image_offset) = PRIV (dst_ptr_offsets)[loc];
(gdb) bt
#0  0x0000000000542303 in dst_restore_location (loc=436144132, abfd=0xb15290)
at vms-alpha.c:1577
#1  _bfd_vms_slurp_etir (abfd=abfd@entry=0xb15290, info=info@entry=0x0) at
vms-alpha.c:2319
#2  0x0000000000543b6a in vms_slurp_debug (abfd=abfd@entry=0xb15290) at
vms-alpha.c:2529
#3  0x000000000054430d in _bfd_vms_slurp_etbt (abfd=0xb15290) at
vms-alpha.c:2559
#4  _bfd_vms_slurp_object_records (abfd=abfd@entry=0xb15290) at
vms-alpha.c:2639
#5  0x0000000000544aca in alpha_vms_object_p (abfd=0xb15290) at
vms-alpha.c:2836
#6  0x000000000040d6a9 in bfd_check_format_matches (abfd=abfd@entry=0xb15290,
format=format@entry=bfd_object, matching=matching@entry=0x7fffffffe1e0)
    at format.c:328
#7  0x0000000000404866 in display_file (filename=0x7fffffffe5b0
"./report/crash1") at nm.c:1375
#8  0x0000000000404d50 in main (argc=2, argv=0x7fffffffe318) at nm.c:1860

-- 
You are receiving this mail because:
You are on the CC list for the bug.