Report

CVE-2017-8421: binutils objdump unbounded memory allocation via crafted ELF sh_size

e0c13f13-7c92-4a8e-8947-aedc0fe2649e

Processing specially crafted ELF files with objdump causes unbounded memory allocation (DoS). bfd/elf.c bfd_elf_get_str_section (lines 277-319): The sh_size field from ELF section headers is used directly as the allocation size (shstrtabsize + 1) with NO check against the actual file size. An attacker sets sh_size to ~2GB in a tiny ELF file, triggering a huge bfd_alloc call. The code only resets sh_size=0 when bfd_bread FAILS after a SUCCESSFUL allocation; when bfd_alloc itself FAILS (OOM), sh_size is NOT reset, allowing repeated allocation attempts on subsequent calls. Also: bfd/elfcode.h (774-779): On BFD64 builds, the overflow check before allocating program header array is wrapped in #ifndef BFD64, so 64-bit builds skip the sanity check. Combined with PN_XNUM extension (e_phnum set to sh_info up to 2^32-1), this enables huge allocations.