<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/85568>85568</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            llvm-objdump can crash due to ELFFile<ELFT>::dynamicEntries() not checking p_offset
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            tools:llvm-objdump,
            crash-on-invalid,
            crash
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          emaste
      </td>
    </tr>
</table>

<pre>
    Reported against FreeBSD in https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277736 which has an attached reproducer

Copied from the FreeBSD bug report:
```
# uname -a
FreeBSD stock14 15.0-CURRENT FreeBSD 15.0-CURRENT #19 main-n268743-a58813fd701e: Sat Mar  9 07:18:21 AST 2024 root@stock14:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64
# objdump --version
LLVM (http://llvm.org/):
  LLVM version 17.0.6
  Optimized build with assertions.
...
# objdump -p ldd1b.exe 
...
PLEASE submit a bug report to https://bugs.freebsd.org/submit/ and include the crash backtrace.
Stack dump:
0.      Program arguments: objdump -p ldd1b.exe
 #0 0x0000000001230c41 PrintStackTrace /usr/src/contrib/llvm-project/llvm/lib/Support/Unix/Signals.inc:602:13
 #1 0x000000000122f0b5 RunSignalHandlers /usr/src/contrib/llvm-project/llvm/lib/Support/Signals.cpp:105:18
 #2 0x0000000001231365 SignalHandler /usr/src/contrib/llvm-project/llvm/lib/Support/Unix/Signals.inc:0:3
 #3 0x00000008249cf5ff handle_signal /usr/src/lib/libthr/thread/thr_sig.c:0:3
 #4 0x00000008249cebbb thr_sighandler /usr/src/lib/libthr/thread/thr_sig.c:244:1
 #5 0x000000082270d2d3 ([vdso]+0x2d3)
 #6 0x0000000000f96641 dynamicEntries /usr/src/contrib/llvm-project/llvm/lib/Object/ELF.cpp:590:24
 #7 0x0000000000df2268 operator bool /usr/src/contrib/llvm-project/llvm/include/llvm/Support/Error.h:559:17
 #8 0x0000000000df2268 printDynamicSection /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/ELFDump.cpp:205:8
 #9 0x0000000000df2268 printPrivateHeaders /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/ELFDump.cpp:431:3
#10 0x0000000000e6a13c dumpObject /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/llvm-objdump.cpp:2815:7
#11 0x0000000000e654b0 dumpInput /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/llvm-objdump.cpp:0:5
#12 0x0000000000e654b0 for_each<std::__1::__wrap_iter<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > *>, void (*)(llvm::StringRef)> /usr/obj/usr/src/amd64.amd64/tmp/usr/include/c++/v1/__algorithm/for_each.h:26:5
#13 0x0000000000e654b0 for_each<std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > &, void (*)(llvm::StringRef)> /usr/src/contrib/llvm-project/llvm/include/llvm/ADT/STLExtras.h:1731:10
#14 0x0000000000e654b0 main /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/llvm-objdump.cpp:3248:3
#15 0x0000000828a2d0aa __libc_start1 /usr/src/lib/libc/csu/libc_start1.c:157:2
Bus error (core dumped)
```
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzEV0tv27oS_jX0hrDAhyTLCy8c27rnADltEKd3a1AkZbGRRIGknLS__oKU_EpdtM09RQ3HMYczno_fPDhi1qp9K-UCJHcgWU9Y7yptFrJh1slJocWXxaPstHFSQLZnqrUO5kbKu-0aqhZWznUW0CUgOSB50e9tVBopCysibfaD6KuqawZIbiv9siv6fcT3CtBcCUDXZDab0RS-VIpXsGIWshYy5xivpIBGdkaLnksD0Bqg5fC50p2SApZGN9BV8oSm6PfeQhvn8QwGKRrfw5JQ2LeskXDKBsnR1jrNn3EMcRKh6erT4-Pmw9Pph6-EgFA8hw1T7bQlaTaL6ZQlWYZpKWYIS0CXcMsc_IcZCOcQzQBd4gzQJcFwuX2CBJEYGq0diNHodGCvtwaQXBefT9-t4YDkrBFpHIVPL_tiAcn_s_mwefx7BQfp6Wi6-Cz6poPT6UEaq3Q7bN3f__cfCEjmQ3WKVF0fmjFCgMxPhEEYtEd7iGcRitLj1sfOqUZ9lQIWvaoFfFGugsxaaZzSrY0GvSiKbkDqYC0ELiL5KuEbvYf7zXK7gbYvGuUgu4gjdPrHCTbYAZJD1gqoWl73QobE4IbZChaMPzvDuBzdbR3jz9CjOp0aRTC8HozeG9ZAZvZ9I1vn_d48wsgIIBRB9IqOL0wo4jGGD0a1Lvh58o7hm5By3TqjijEK087oz5K7cen_hb1t34VcJvmnVr16gdq3rLaRajmgyxQRn1r0DAVfQyElKhL42LeD3V-sFbU09v8Fc0TBO88fRsmQ4CcU5A0hmKYJvILwW-hAgC4vuKBnFBmJ57xMyhJWwf_OBsO3KAYvtSpc5YWuMpKJ4Yu3iG44id84kUVRwFG_un3Wn_FCYt8S8NlPcumHzJAggvqCBsndQVgNkjUgd-iVCOpL-WSWXkYClfM0jTEUX1rWKL7xlMt3JsPHYpRu7vMxD5I5CsjP3mdX3kVJSJpB3UnDnDaw0PqbCPzI-VjaZ8E5JTbGaBNVHkjimxmenYFkt4B0vkLXAxdbyX3_-lU4TuvaHnfHJjFwsu6bbuSFhPq4KI_5d9E8GHVgTv4lmXhHmf4Umpjicwb7jnHVvZBMGaY8tMYhxP8SiMvlkZcMe2JmZyj4DZQkLlCA8nfb9b8Ric_b5AyD3IJRarOTjFeArqwT_tqgy90OH7-8GNbtlJPm5n7BrOI764xq94CueMUMICv4raLf2TnDlL93Bj26ua3K6lpzX0hnRRj-yHK0OWglQo8gS98USBaICcbbAOVRluHi38CfHj5c4HDYPxcjB-QuvPMDBiTf7Vi910a5ysfhyFyoTZJec01_meuD5MOh_yjNP1b-w1lwyob0vanwzo68XD_5vvx0v3l1htkQdTwLXQefZ3Ac3wq8H6l_X5lTEmfXve_qVs0YEYgxuNvVqvBxYsbh717eAZrtx8WoHe5unPiBnwxe7noLpb-ZPPtcGxn6mRSnW_r0eDIRCyrmdM4mcoFnGKVZHKN0Ui0oTSWaZ4iXsYwL7kHKZM4zUhZJnBZ0ohb-iQJRPMMxSuM4oiWaZ7M5RqjMBJ4zECPZMFVHx4l_oqzt5SJLkjSb1KyQtQ3PfoQMbNLlNZsEkBUgJAzTU91OVXtgtRLXG36VrCdmEWz9lA5iVCvr7NmvU66Wi8sfh5y145Queumn_c19nqtaArra3OdPPvNDnl5PLSGX57DVDvJK8mfV7mG302VppZv0pl5cPzPslav6IuK6uRhkrtMpUOITKbDyvwAAAP__Iv-MUA">