angr / angr/angr

arm_elf_fast indirect jump resolver raises IndexError on an empty constants list

Offen
#6,769 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
Python
Sterne
9.1k
Forks
1.2k
Ø Merge
16 Std. 20 Min.
Gemergte PRs (30 T.)
169

Beschreibung

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

## Summary

The `arm_elf_fast` indirect-jump resolver crashes `CFGFast` with
`IndexError: list index out of range`:

```text
angr/analyses/cfg/indirect_jump_resolvers/arm_elf_fast.py:91 in _resolve_put
load_addr += next_stmt.constants[0].value
IndexError: list index out of range
```

The loop accepts any `WrTmp` whose data is a `Binop` with `Add` in its operator
name, then unconditionally reads `constants[0]`:

```python
for next_stmt in block.statements:
if (isinstance(next_stmt, pyvex.IRStmt.WrTmp)
and isinstance(next_stmt.data, pyvex.IRExpr.Binop)
and "Add" in next_stmt.data.op):
load_addr += next_stmt.constants[0].value
```

An add of two temporaries carries no constants, so the list is empty. The
resolver is a heuristic and returns `False, []` a few lines later when the shape
does not match; it should reach that path rather than raise.

A failing indirect-jump resolver takes the whole analysis with it, because
resolvers run inside the scan.

## Reproduction

```python
import angr

proj = angr.Project(
"tests/armel/cfg_arm_elf_fast_resolve_put",
auto_load_libs=False,
use_sim_procedures=False,
load_options={"main_opts": {"backend": "elf"}},
)
proj.analyses.CFGFast(normalize=True, resolve_indirect_jumps=True)
```

Fixture: `tests/armel/cfg_arm_elf_fast_resolve_put` on branch
`audit/cfg-relocatable-gap-fixture` of angr/binaries, sha256
`ac7420b96b6dbc22f5bebe863cde3f43f6bc385722f2a0660bd25af89ac85695` — an
unmodified 100 KB ARM ELF from a musl toolchain build.

Tested with angr `d4ebf5654b76aab69be69598220c15c80e73bb73`, pyvex
`26f2b61c618bdd4e01be44562c97b824be399200`.

## Scope

4 units in a corpus sweep running `CFGFast`, all real-world ARM ELF. Small in
count, but it needs `resolve_indirect_jumps=True`, which is the default.

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.