GNU binutils - 'print_insn_score16' Buffer Overflow







Become a Certified Penetration Tester

Enroll in Penetration Testing with Kali Linux and pass the exam to become an Offensive Security Certified Professional (OSCP). All new content for 2020.


I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the
ASAN report log ("Output"). Below is the reduced stacktrace with links to the
corresponding source lines on a GitHub mirror.

The command I used was `objdump -D <file>`.

Let me know if there is any additional information I can provide.


Input: 2a13a720199253614962e0bb4402d98c.9149a6478708ae7cb458345e7cbc9354.min
Output: 2a13a720199253614962e0bb4402d98c.9149a6478708ae7cb458345e7cbc9354.txt

Error in "print_insn_score16": global-buffer-overflow
  in print_insn_score16 at opcodes/score7-dis.c:723
  in s7_print_insn at opcodes/score7-dis.c:954
  in disassemble_bytes at binutils/objdump.c:1864
  in disassemble_section at binutils/objdump.c:2309
  in bfd_map_over_sections at bfd/section.c:1395
  in disassemble_data at binutils/objdump.c:2445
  in dump_bfd at binutils/objdump.c:3547
  in display_file at binutils/objdump.c:3714
  in main at binutils/objdump.c:4016

Additional Information:
The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.

Proof of Concept: