nullptr read in bin.c

[m4drat]

Hi! We've been fuzzing your project and found the following error in librz/bin/bin.c

Work environment

OS: Ubuntu 20.04
File format: -
rizin version: 4b38597

Bug description

Nullptr read in librz/bin/bin.c:1435:37

Steps to reproduce

1. Build docker container from https://github.com/ispras/oss-sydr-fuzz/tree/master/projects/rizin: sudo docker build -t oss-sydr-fuzz-rizin .

2. Run docker container: sudo docker run --privileged --network host -v /etc/localtime:/etc/localtime:ro --rm -it -v $PWD:/fuzz oss-sydr-fuzz-rizin /bin/bash

3. Execute rizin with crashing input (we sent all crashing inputs to you by email):
   /rizin-fuzzing/libfuzzer-asan/bin/rizin -qq crash-644b46a2d588124d9c0366596f1b88de920cffbc

4. You will see the following output:

WARNING: bin_file_strings: search interval size (0x40000000000050) exeeds bin.maxstrbuf (0xa00000), skipping it.
WARNING: bin_file_strings: search interval size (0x40000000000050) exeeds bin.maxstrbuf (0xa00000), skipping it.
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2487814==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000220 (pc 0x000000ae2e97 bp 0x7ffc0b705e30 sp 0x7ffc0b705d40 T0)
==2487814==The signal is caused by a READ memory access.
==2487814==Hint: address points to the zero page.
    #0 0xae2e97 in rz_bin_demangle /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bin.c:1435:37
    #1 0x146a578 in parse_function /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/analysis/dwarf_process.c:1481:19
    #2 0x146a578 in parse_type_entry /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/analysis/dwarf_process.c:1585:3
    #3 0x146a578 in rz_analysis_dwarf_process_info /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/analysis/dwarf_process.c:1619:4
    #4 0xfc731d in rz_core_bin_apply_dwarf /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/core/cbin.c:669:3
    #5 0xfc6039 in rz_core_bin_apply_info /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/core/cbin.c:281:3
    #6 0xfcc48d in rz_core_bin_apply_all_info /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/core/cbin.c:334:2
    #7 0x10033b0 in core_file_do_load_for_io_plugin /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/core/cfile.c:735:6
    #8 0x10033b0 in rz_core_bin_load /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/core/cfile.c:974:4
    #9 0x5b9af8 in rz_main_rizin /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/main/rizin.c:1119:14
    #10 0x7f4dd2304082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #11 0x41da3d in _start (/home/madrat/Desktop/rizin-report/rz-installation-asan/bin/rizin+0x41da3d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bin.c:1435:37 in rz_bin_demangle
==2487814==ABORTING

[wargio]

attach the bin here so we can reproduce this.

[m4drat]

Crashing input: crash-644b46a2d588124d9c0366596f1b88de920cffbc.zip