GNU binutils 'rx_decode_opcode' Buffer Overflow

Risk: High
Local: No
Remote: Yes
CWE: CWE-119

I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer. Please find attached the minimized file causing the issue ("Input") and the ASAN report log ("Output"). Below is the reduced stacktrace with links to the corresponding source lines on a GitHub mirror. The command I used was `objdump -D <file>`. Let me know if there is any additional information I can provide. -- Input: 9ed130cf25d8df5207cad7fc0de4fc1f.109246746a4907b00292c7837b29f085.min Output: 9ed130cf25d8df5207cad7fc0de4fc1f.109246746a4907b00292c7837b29f085.txt Error in "rx_decode_opcode": global-buffer-overflow in rx_decode_opcode at opcodes/rx-decode.opc:288 (see in print_insn_rx at opcodes/rx-dis.c:123 (see in disassemble_bytes at binutils/objdump.c:1864 (see in disassemble_section at binutils/objdump.c:2309 (see in bfd_map_over_sections at bfd/section.c:1395 (see in disassemble_data at binutils/objdump.c:2445 (see in dump_bfd at binutils/objdump.c:3547 (see in display_file at binutils/objdump.c:3714 (see in main at binutils/objdump.c:4016 (see Additional Information: The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.


Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018,


Back to Top