Hi,
after the recent security update of binutils, objcopy segfaults for a
particular input file.
The change has been introduced with CVE-2014-8503_8502_8737.diff.
$ objcopy -j .text -j .sdata -j .data -j .dynamic -j .dynsym -j .rel -j .rela -j .reloc --target=efi-app-ia32 efi_hello.elfpic efi_hello.efi
Segmentation fault
$ LD_LIBRARY_PATH=/tmp/binutils-2.22/builddir-multi/bfd/.libs gdb --args /tmp/binutils-2.22/builddir-multi/binutils/.libs/objcopy -j .text -j .sdata -j .data -j .dynamic -j .dynsym -j .rel -j .rela -j .reloc --target=efi-app-ia32 efi_hello.elfpic efi_hello.efi
GNU gdb (GDB) 7.4.1-debian
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /tmp/binutils-2.22/builddir-multi/binutils/.libs/objcopy...done.
(gdb) r
Starting program: /tmp/binutils-2.22/builddir-multi/binutils/.libs/objcopy -j .text -j .sdata -j .data -j .dynamic -j .dynsym -j .rel -j .rela -j .reloc --target=efi-app-ia32 efi_hello.elfpic efi_hello.efi
Program received signal SIGSEGV, Segmentation fault.
coff_write_alien_symbol (debug_string_size_p=0xffffcc08,
debug_string_section_p=0xffffcbfc, string_size_p=0xffffcc00,
written=0xffffcc10, symbol=0x808ae4c, abfd=0x0) at ../../bfd/coffgen.c:1038
1038 if (! obj_pe (abfd))
(gdb) bt
#0 coff_write_alien_symbol (debug_string_size_p=0xffffcc08,
debug_string_section_p=0xffffcbfc, string_size_p=0xffffcc00,
written=0xffffcc10, symbol=0x808ae4c, abfd=0x0) at ../../bfd/coffgen.c:1038
#1 coff_write_symbols (abfd=0x0, abfd@entry=0x807f968)
at ../../bfd/coffgen.c:1168
#2 0xf7dc4252 in coff_write_object_contents (abfd=0x807f968)
at ../../bfd/coffcode.h:4177
#3 0xf7d60158 in bfd_close (abfd=abfd@entry=0x807f968)
at ../../bfd/opncls.c:708
#4 0x0805133a in copy_file (
input_filename=input_filename@entry=0xffffdd8c "efi_hello.elfpic",
output_filename=output_filename@entry=0xffffdd9d "efi_hello.efi",
input_target=input_target@entry=0x807d738 "pei-i386",
output_target=output_target@entry=0x807d748 "pei-i386",
input_arch=input_arch@entry=0x0) at ../../binutils/objcopy.c:2311
#5 0x0804be1d in copy_main (argv=0xffffdb84, argc=20)
at ../../binutils/objcopy.c:3957
#6 main (argc=20, argv=0xffffdb84) at ../../binutils/objcopy.c:4053
(gdb) print abfd
$1 = (bfd *) 0x0
For some reason abfd is set to 0 while in the first loop in
coff_write_symbols.
I do not see this behavior (segfault) on amd64 nor on sid/i386.
I have put efi_hello.elfpic to
http://os.inf.tu-dresden.de/~adam/tmp/efi_hello.elfpic
Adam