heap-buffer-overflow in ELFIO::note_section_accessor_template

[gy741]

Hello.

I found a heap-buffer-overflow in ELFIO.

Please confirm.

Thanks.

OS: CentOS 7 64bit Version: 1fdbb6423528684e7b5d6dd9095b64f5617b1434 PoC Download: ov_note_section_accessor_template.zip

Steps to reproduce: 1.Download the .POC files. 2.Execute the following command : ./elfdump $FILE

=================================================================
==23389==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000031 at pc 0x7f10d43d5733 bp 0x7ffd9f3604c0 sp 0x7ffd9f35fc68
READ of size 4294967295 at 0x604000000031 thread T0
    #0 0x7f10d43d5732  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x79732)
    #1 0x7f10d40fbab4 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x125ab4)
    #2 0x7f10d40fc7ea in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_replace(unsigned long, unsigned long, char const*, unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x1267ea)
    #3 0x55698a59bd12 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::assign(char const*, unsigned long) /usr/include/c++/7/bits/basic_string.h:1403
    #4 0x55698a59bd12 in ELFIO::note_section_accessor_template<ELFIO::section>::get_note(unsigned int, unsigned int&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&, void*&, unsigned int&) const ../../elfio/elfio_note.hpp:83
    #5 0x55698a59bd12 in ELFIO::dump::notes(std::ostream&, ELFIO::elfio const&) ../../elfio/elfio_dump.hpp:693
    #6 0x55698a54f1c6 in main /home/karas/ELFIO/examples/elfdump/elfdump.cpp:53
    #7 0x7f10d3a001c0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x211c0)
    #8 0x55698a551d49 in _start (/home/karas/ELFIO/examples/elfdump/elfdump+0xfd49)

0x604000000031 is located 0 bytes to the right of 33-byte region [0x604000000010,0x604000000031)
allocated by thread T0 here:
    #0 0x7f10d443c618 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xe0618)
    #1 0x55698a55e4f8 in ELFIO::section_impl<ELFIO::Elf32_Shdr>::load(std::istream&, std::fpos<__mbstate_t>) ../../elfio/elfio_section.hpp:248
    #2 0x55698a5a3abf  (/home/karas/ELFIO/examples/elfdump/elfdump+0x61abf)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x79732) 
Shadow bytes around the buggy address:
  0x0c087fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c087fff8000: fa fa 00 00 00 00[01]fa fa fa 00 00 00 00 03 fa
  0x0c087fff8010: fa fa 00 00 00 00 01 fa fa fa 00 00 00 00 00 01
  0x0c087fff8020: fa fa 00 00 00 00 01 fa fa fa fa fa fa fa fa fa
  0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==23389==ABORTING

========== [Acknowledgement] This work was supported by ICT R&D program of MSIP/IITP. [R7518-16-1001, Innovation hub for high Performance Computing]

[serge1]

Steps for reproducing are not clear