Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SEGV on PackLinuxElf64::invert_pt_dynamic #631

Closed
MaggieCwj opened this issue Nov 24, 2022 · 1 comment
Closed

SEGV on PackLinuxElf64::invert_pt_dynamic #631

MaggieCwj opened this issue Nov 24, 2022 · 1 comment
Labels
Milestone

Comments

@MaggieCwj
Copy link

MaggieCwj commented Nov 24, 2022

This issue tracker is ONLY used for reporting bugs.
Please use stackoverflow for supporting issues.

What's the problem (or question)?

UPX4.0.1 shows "Bus Error".
SEGV on /home/chen/upx/src/p_lx_elf.cpp:5783 PackLinuxElf64::invert_pt_dynamic(N_Elf::Dyn<N_Elf::ElfITypes<LE16, LE32, LE64, LE64, LE64> > const*, unsigned long long)

ASAN

                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2022
UPX git-fdec47+ Markus Oberhumer, Laszlo Molnar & John Reiser   Nov 16th 2022

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
ASAN:SIGSEGV
=================================================================
==33120==ERROR: AddressSanitizer: SEGV on unknown address 0x1000b7ff78d0 (pc 0x000000484c1d bp 0x7fffffffc9f0 sp 0x7fffffffc610 T0)
    #0 0x484c1c in PackLinuxElf64::invert_pt_dynamic(N_Elf::Dyn<N_Elf::ElfITypes<LE16, LE32, LE64, LE64, LE64> > const*, unsigned long long) /home/chen/upx/src/p_lx_elf.cpp:5783
    #1 0x495c66 in PackLinuxElf64::invert_pt_dynamic(N_Elf::Dyn<N_Elf::ElfITypes<LE16, LE32, LE64, LE64, LE64> > const*, unsigned long long) /home/chen/upx/src/p_lx_elf.cpp:825
    #2 0x495c66 in PackLinuxElf64::PackLinuxElf64help1(InputFile*) /home/chen/upx/src/p_lx_elf.cpp:826
    #3 0x496c6a in PackLinuxElf64Le::PackLinuxElf64Le(InputFile*) /home/chen/upx/src/p_lx_elf.h:430
    #4 0x496c6a in PackLinuxElf64amd::PackLinuxElf64amd(InputFile*) /home/chen/upx/src/p_lx_elf.cpp:1042
    #5 0x5757a0 in PackMaster::visitAllPackers(Packer* (*)(Packer*, void*), InputFile*, options_t const*, void*) /home/chen/upx/src/packmast.cpp:194
    #6 0x577311 in PackMaster::getPacker(InputFile*) /home/chen/upx/src/packmast.cpp:238
    #7 0x57744f in PackMaster::pack(OutputFile*) /home/chen/upx/src/packmast.cpp:258
    #8 0x61ca72 in do_one_file(char const*, char*) /home/chen/upx/src/work.cpp:157
    #9 0x61cf89 in do_files(int, int, char**) /home/chen/upx/src/work.cpp:271
    #10 0x45fe9f in upx_main(int, char**) /home/chen/upx/src/main.cpp:1266
    #11 0x407223 in main /home/chen/upx/src/main.cpp:1324
    #12 0x7ffff621f83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
    #13 0x409ef8 in _start (/home/chen/ifcut/upx/upx-asan+0x409ef8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/chen/upx/src/p_lx_elf.cpp:5783 PackLinuxElf64::invert_pt_dynamic(N_Elf::Dyn<N_Elf::ElfITypes<LE16, LE32, LE64, LE64, LE64> > const*, unsigned long long)
==33120==ABORTING

gdb

(gdb) bt
#0  0x0000000000484c1d in PackLinuxElf64::invert_pt_dynamic (
    this=this@entry=0x61b00001f180, dynp=<optimized out>, headway=<optimized out>)
    at /home/chen/upx/src/p_lx_elf.cpp:5783
#1  0x0000000000495c67 in PackLinuxElf64::invert_pt_dynamic (headway=<optimized out>, 
    dynp=<optimized out>, this=0x61b00001f180) at /home/chen/upx/src/p_lx_elf.cpp:825
#2  PackLinuxElf64::PackLinuxElf64help1 (this=this@entry=0x61b00001f180, 
    f=f@entry=0x7fffffffcc70) at /home/chen/upx/src/p_lx_elf.cpp:826
#3  0x0000000000496c6b in PackLinuxElf64Le::PackLinuxElf64Le (f=0x7fffffffcc70, 
    this=0x61b00001f180) at /home/chen/upx/src/p_lx_elf.h:430
#4  PackLinuxElf64amd::PackLinuxElf64amd (this=0x61b00001f180, f=0x7fffffffcc70)
    at /home/chen/upx/src/p_lx_elf.cpp:1042
#5  0x00000000005757a1 in PackMaster::visitAllPackers (
    func=0x577870 <try_pack(Packer*, void*)>, f=0x7fffffffcc70, o=0x7fffffffce88, 
    user=0x7fffffffcc70) at /home/chen/upx/src/packmast.cpp:194
#6  0x0000000000577312 in PackMaster::getPacker (f=<optimized out>)
    at /home/chen/upx/src/packmast.cpp:238
#7  0x0000000000577450 in PackMaster::pack (this=this@entry=0x7fffffffce70, 
    fo=fo@entry=0x7fffffffcd70) at /home/chen/upx/src/packmast.cpp:258
#8  0x000000000061ca73 in do_one_file (iname=iname@entry=0x7fffffffdede "./POC2", 
    oname=oname@entry=0x7fffffffd4c0 "./POC2.000") at /home/chen/upx/src/work.cpp:157
#9  0x000000000061cf8a in do_files (i=i@entry=1, argc=argc@entry=2, 
    argv=argv@entry=0x7fffffffda98) at /home/chen/upx/src/work.cpp:271
#10 0x000000000045fea0 in upx_main (argc=<optimized out>, argv=<optimized out>)
    at /home/chen/upx/src/main.cpp:1266
#11 0x0000000000407224 in main (argc=2, argv=0x7fffffffda98)
    at /home/chen/upx/src/main.cpp:1324

What should have happened?

No Bus error.

Do you have an idea for a solution?

How can we reproduce the issue?

  1. Build UPX 4.0.1 (the latest version)
  2. Run
    ./upx ./POC2

zipped poc:
POC2.zip

Please tell us details about your environment.

  • UPX version used (upx --version):
./upx --version
upx v4.0.1-dirty
UCL data compression library 1.03
zlib data compression library 1.2.13
LZMA SDK version 4.43
doctest C++ testing framework version 2.4.9
Copyright (C) 1996-2022 Markus Franz Xaver Johannes Oberhumer
Copyright (C) 1996-2022 Laszlo Molnar
Copyright (C) 2000-2022 John F. Reiser
Copyright (C) 2002-2022 Jens Medoch
Copyright (C) 1995-2022 Jean-loup Gailly and Mark Adler
Copyright (C) 1999-2006 Igor Pavlov
Copyright (C) 2016-2021 Viktor Kirilov
UPX comes with ABSOLUTELY NO WARRANTY; for details type 'upx -L'.
  • Host Operating System and version:
    Ubuntu 16.04 LTS
  • Host CPU architecture:
    11th Gen Intel® Core™ i5-11500 @ 2.70GHz × 8
  • Target Operating System and version:
    same as Host
  • Target CPU architecture:
    same as Host
@MaggieCwj MaggieCwj changed the title SEGV on upx/src/p_lx_elf.cpp:5783 PackLinuxElf64::invert_pt_dynamic(N_Elf::Dyn<N_Elf::ElfITypes<LE16, LE32, LE64, LE64, LE64> > const*, unsigned long long) SEGV on PackLinuxElf64::invert_pt_dynamic Nov 24, 2022
jreiser added a commit that referenced this issue Nov 24, 2022
@jreiser
Copy link
Collaborator

jreiser commented Nov 24, 2022

Fixed by above commit 124ae05 .

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants