Re: Re: strings / libbfd crasher

[Alexander Cherepanov <cherepan () mccme ru>]

On 2014-10-27 01:05, cve-assign () mitre org wrote:
> There is currently no CVE ID for the
> psa-dont-run-strings-on-untrusted-files.html "0xdeadbabe October 25,
> 2014 7:20 PM" comment about "another one related with PE file headers
> parsing." In general, a separate discovery that's potentially
> exploitable for code execution could have its own CVE ID. Does anyone
> want a CVE ID for that?

I don't know whether it's the same crash or not but I've dug results of 
my older experiments with zzuf. Attached are two crasher for `objdump 
-x` -- one pe and one elf. elf also crashes `strings`. Sorry, not 
researched.

--
Alexander Cherepanov

Attachment: objdump-pe-crasher.xz
Description:

Attachment: objdump-elf-crasher.xz
Description: