<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/86612>86612</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            llvm-objdump: printDynamicSection() out-of-bounds read
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            tools:llvm-objdump,
            crash-on-invalid
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          emaste
      </td>
    </tr>
</table>

<pre>
    Reported against FreeBSD at https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277885, with attached ELF reproducer.

```
# llvm-objdump --version
LLVM (http://llvm.org/):
  LLVM version 17.0.6
  Optimized build with assertions.
...
# llvm-objdump -x objdump10a.exe
...
Dynamic Section:
  NEEDED       PLEASE submit a bug report to https://bugs.freebsd.org/submit/ and include the crash backtrace.
Stack dump:
0.      Program arguments: llvm-objdump -x objdump10a.exe
 #0 0x0000000001230c41 PrintStackTrace /usr/src/contrib/llvm-project/llvm/lib/Support/Unix/Signals.inc:602:13
 #1 0x000000000122f0b5 RunSignalHandlers /usr/src/contrib/llvm-project/llvm/lib/Support/Signals.cpp:105:18
 #2 0x0000000001231365 SignalHandler /usr/src/contrib/llvm-project/llvm/lib/Support/Unix/Signals.inc:0:3
 #3 0x00000008267d55ff handle_signal /usr/src/lib/libthr/thread/thr_sig.c:0:3
 #4 0x00000008267d4bbb thr_sighandler /usr/src/lib/libthr/thread/thr_sig.c:244:1
 #5 0x0000000822def2d3 ([vdso]+0x2d3)
 #6 0x0000000828b3a7eb /usr/src/lib/libc/amd64/string/strlen.S:95:0
 #7 0x0000000000df28c9 __constexpr_strlen /usr/obj/usr/src/amd64.amd64/tmp/usr/include/c++/v1/__string/constexpr_c_functions.h:49:10
 #8 0x0000000000df28c9 length /usr/obj/usr/src/amd64.amd64/tmp/usr/include/c++/v1/__string/char_traits.h:222:14
 #9 0x0000000000df28c9 StringRef /usr/src/contrib/llvm-project/llvm/include/llvm/ADT/StringRef.h:90:33
#10 0x0000000000df28c9 operator<< /usr/src/contrib/llvm-project/llvm/include/llvm/Support/raw_ostream.h:244:29
#11 0x0000000000df28c9 printDynamicSection /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/ELFDump.cpp:233:16
#12 0x0000000000df28c9 printPrivateHeaders /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/ELFDump.cpp:431:3
#13 0x0000000000e6a13c dumpObject /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/llvm-objdump.cpp:2815:7
#14 0x0000000000e654b0 dumpInput /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/llvm-objdump.cpp:0:5
#15 0x0000000000e654b0 for_each<std::__1::__wrap_iter<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > *>, void (*)(llvm::StringRef)> /usr/obj/usr/src/amd64.amd64/tmp/usr/include/c++/v1/__algorithm/for_each.h:26:5
#16 0x0000000000e654b0 for_each<std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > &, void (*)(llvm::StringRef)> /usr/src/contrib/llvm-project/llvm/include/llvm/ADT/STLExtras.h:1731:10
#17 0x0000000000e654b0 main /usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/llvm-objdump.cpp:3248:3
#18 0x0000000828a660aa __libc_start1 /usr/src/lib/libc/csu/libc_start1.c:157:2
Segmentation fault (core dumped)
```

</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzEl1-PmzgQwD-N82IF-Q8Q8pCH7CaoJ-1dq27vXpGxHXALGNkmu-2nP9mQkOyl1_9qlM0CnmF-Hs-Mx8xaVXVSbkByB5Ldgg2u1mYjW2adXJRafNy8lb02TgrIKqY662BupLx73EHmYO1cbwHdApIDkpdDZaODkbK0ItKmGh99Uk3DAMltrZ-KcqgiXilAcyUA3ZHVKssSQO7hk3I1ZM4xXksB9w85NLI3WgxcmgigHUDb6TdF03e8JRQ2zbFd6vK9GNoeLpdHaazS3Tj-8PDPnxCQzJOeQb3CBAjI2j8OshAG6Ukf4lWEovQ09Lp3qlWfpIDloBoxAVsrjVO6sxNjFEWf43qG0yVGLJLP8oXC7mPHWsXho-T-hRdQf-33u_0Ojp83D_vt4x7aoWyVgwyWQ-U9pY2DTn95PUY9QHLIOgFVx5tBSOhqCblhtoYl4x-cYVxOVI-O8Q_QU5-BUDSRGF0Z1kJmqqGVnfN2v2rKEBCKIHpGpw8mFPEYwzdGdS5YfOcRICD5YI2nNhyQnOvOGVVO67fsjX4vuZtu_b8w9jj03huA5H936tk_UFXHGhupjgO6TREBdIvpjIKvUcgBlQl8O3Sj3ivWiUYa-6MwJwree09ilPjfbKYgLxyCaZrAK4Rf4g4E6PbCF3SmyEi6EklyOMA62C9sUHxJMVppVOlq_9DVRjIxXniN6IaR-IWRuCxLOMnXt-f6NVZIHHufznaSSztEyAMR1JcCkNwdhdUg2QFyh56JoL4InNXSS7WspGwly8_y-BvWijT2Q86orhovGtlFj4Bu10mY__nlq8tlRuJAMr6GRcF1Z5187k0x6s72dPn-he1gLjoZdW1_Hp_S2ccGIHfhmx8xIHlRnNlmS7w4DB0fi1cN6DZeh8CcWbNbrI3sKlf_Qr6amcIZptxIRUjI13jGWt_Cegz6b-XhW7NkZpoebHfvfJac3hcg1iGC6bmyY3SLQffSMKcNoPeA3v8wyJy5hj0V2jojWTv6JET6KWY9D77F0_tyOm0r067yrVBO68aeRqdaDki-f8h3Q9tPxYxQ6pconXHIZ3HeGHVkTr6STHxHUf0qnJjiud54GnpFI1OGKQ9b2uvSv_4nQVzenhyTYZ_-qxklfoGSxCUKKH90_fALSXz8JjNGcgvjoE0hGa8BvbdO-O2ebosCny6eDOsL5aS5OV4yq_gpi-m9z2Lf1f1X8CK_T3J0f1uUNY3mU0JNgjD8ke2kc9RKhIpOtr6Ekyw4JiifEzg0ePufXrBYU2mjXO3X4eS5MTnTa1-n3-zro-TjpH-rm78s_Juj4BwN6feGwo_tEO8e9s_OsHGbwqtQdfB8KsGrWwvfMvWzivCNNKckzq5rX3bVzLA0RYzBovCdS2EdMw7_b2vD7TDdTNKh08LJygf6dEKQle_-WdheDmxofBnLuDYyFDYpzs3Vi5PbQmyoWNM1W8gNXmEc4zjFZFFveJyVqyRGnFPCSIqzTCSY4FKsUZwQmi7UhiASI0pShJI0IVGMVzHP2DpBOE3ZKgUxki1TTXQ66C2UtYPcZKm30LBSNjaceAkZnUu3184lgNwDQsKZaKm7peqOrFHCDyS7hdkEaX-8AjFqlHV2tuSUa-Tm6nV0e2svDsG6hnpwS31YlnrohIW-r10Mptlcn-Qq5eqhjLhuL_r762AJM_RhEib5bwAAAP__yL3Kaw">