debug/elf: slice bounds out of range

[dvyukov]

The following program crashes with the panic on the provided inputs:

package main

import (
    "bytes"
    "debug/elf"
    "io/ioutil"
    "os"
)

func main() {
    data, _ := ioutil.ReadFile(os.Args[1])
    f, err := elf.NewFile(bytes.NewReader(data))
    if err != nil {
        if f != nil {
            panic("file is not nil on error")
        }
        return
    }
    defer f.Close()
    f.DynamicSymbols()
    f.ImportedLibraries()
    f.ImportedSymbols()
    f.Section(".data")
    f.SectionByType(elf.SHT_GNU_VERSYM)
    f.Symbols()
    dw, err := f.DWARF()
    if err != nil {
        if dw != nil {
            panic("dwarf is not nil on error")
        }
        return
    }
    dr := dw.Reader()
    for {
        e, _ := dr.Next()
        if e == nil {
            break
        }
    }
}

On input https://drive.google.com/file/d/0B20Uwp8Hs1oCQmk0YU1JaXM1N0E/view?usp=sharing

panic: runtime error: slice bounds out of range

goroutine 1 [running]:
debug/elf.(*File).DynString(0xc208076000, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0)
    src/debug/elf/file.go:1053 +0x6ad
debug/elf.(*File).ImportedLibraries(0xc208076000, 0x0, 0x0, 0x0, 0x0, 0x0)
    src/debug/elf/file.go:1015 +0x4e
main.main()
    elftest.go:21 +0x1ec

On input https://drive.google.com/file/d/0B20Uwp8Hs1oCOXlsZGhXY2NhOW8/view?usp=sharing

panic: runtime error: index out of range

goroutine 1 [running]:
encoding/binary.(*littleEndian).Uint16(0x645be8, 0xc20800a954, 0x1, 0x1, 0xc208040003)
    <autogenerated>:8 +0xc9
debug/elf.(*File).gnuVersion(0xc208076000, 0x14, 0xc2080800f0)
    src/debug/elf/file.go:1002 +0xb8
debug/elf.(*File).ImportedSymbols(0xc208076000, 0x0, 0x0, 0x0, 0x0, 0x0)
    src/debug/elf/file.go:914 +0x348
main.main()
    elftest.go:22 +0x1fa

on commit 596bb76

[rsc]

It's too late in the Go 1.5 release process for fuzzer bugs. The chance of hitting any of these is so low that the benefit of the fix is outweighed by the chance of the fix introducing a more serious bug.

[brycekahle]

@dvyukov do you still have those files? The links no longer work.

[dvyukov]

No, I don't have them now. But running go-fuzz on the package is likely to re-reproduce it (good idea anyway b/c there are likely more bugs after this one). The fuzzer probably needs to be seeded with some real ELF binaries.

[ianlancetaylor]

Note that there has been a lot of fuzzing work on debug/elf since this bug was opened in 2015: https://github.com/golang/go/issues?q=is%3Aissue+author%3Acatenacyber+debug%2Felf

[ianlancetaylor]

See also #47653 .

[ianlancetaylor]

These reports are almost certainly a dup of #63610 and #56429. Closing.