arm_elf_fast indirect jump resolver raises IndexError on an empty constants list
- Vorherrschende Sprache
- Python
- Sterne
- 9.1k
- Forks
- 1.2k
- Ø Merge
- 16 Std. 20 Min.
- Gemergte PRs (30 T.)
- 169
Beschreibung
THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS
## Summary
The `arm_elf_fast` indirect-jump resolver crashes `CFGFast` with
`IndexError: list index out of range`:
```text
angr/analyses/cfg/indirect_jump_resolvers/arm_elf_fast.py:91 in _resolve_put
load_addr += next_stmt.constants[0].value
IndexError: list index out of range
```
The loop accepts any `WrTmp` whose data is a `Binop` with `Add` in its operator
name, then unconditionally reads `constants[0]`:
```python
for next_stmt in block.statements:
if (isinstance(next_stmt, pyvex.IRStmt.WrTmp)
and isinstance(next_stmt.data, pyvex.IRExpr.Binop)
and "Add" in next_stmt.data.op):
load_addr += next_stmt.constants[0].value
```
An add of two temporaries carries no constants, so the list is empty. The
resolver is a heuristic and returns `False, []` a few lines later when the shape
does not match; it should reach that path rather than raise.
A failing indirect-jump resolver takes the whole analysis with it, because
resolvers run inside the scan.
## Reproduction
```python
import angr
proj = angr.Project(
"tests/armel/cfg_arm_elf_fast_resolve_put",
auto_load_libs=False,
use_sim_procedures=False,
load_options={"main_opts": {"backend": "elf"}},
)
proj.analyses.CFGFast(normalize=True, resolve_indirect_jumps=True)
```
Fixture: `tests/armel/cfg_arm_elf_fast_resolve_put` on branch
`audit/cfg-relocatable-gap-fixture` of angr/binaries, sha256
`ac7420b96b6dbc22f5bebe863cde3f43f6bc385722f2a0660bd25af89ac85695` — an
unmodified 100 KB ARM ELF from a musl toolchain build.
Tested with angr `d4ebf5654b76aab69be69598220c15c80e73bb73`, pyvex
`26f2b61c618bdd4e01be44562c97b824be399200`.
## Scope
4 units in a corpus sweep running `CFGFast`, all real-world ARM ELF. Small in
count, but it needs `resolve_indirect_jumps=True`, which is the default.
Beitragsleitfaden
Für dieses Repository ist kein Beitragsleitfaden indexiert
Bewertung
Dieses Issue wurde noch nicht bewertet.