Sleigh segfaults on short inputs for JVM, NDS32 and SPARC
- Dominant language
- C++
- Stars
- 214
- Forks
- 30
- PR merge metrics
- No merged PRs in 30d
Description
THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS
Three Sleigh language definitions segfault on short byte sequences. They are
almost certainly three separate defects and can be split if that is easier to
triage — they are together here because they came out of one survey and share a
shape: a small input, no exception, the process gone.
All three reproduce on `559aacdc`, which is `master` at the time of writing, and
each is a bare `translate` call with no other state.
**1. JVM — `tableswitch`**
```python
pypcode.Context("JVM:BE:32:default").translate(
bytes.fromhex("aa873b8e6f50b409"), 0x1001,
max_instructions=99999, max_bytes=8,
flags=pypcode.TranslateFlags.BB_TERMINATING)
```
`0xaa` is `tableswitch`; `0xab` (`lookupswitch`) fails the same way. Eight bytes.
**2. NDS32**
```python
pypcode.Context("NDS32:LE:32:default").translate(
bytes.fromhex("26095d273add"), 0x1010,
max_instructions=99999, max_bytes=6,
flags=pypcode.TranslateFlags.BB_TERMINATING)
```
Six bytes.
**3. SPARC**
```python
pypcode.Context("sparc:BE:32:default").translate(
bytes.fromhex("1728394a5b6c7d8e9fb0c1d2b01e0019"), 0x14,
max_instructions=99999, max_bytes=16,
flags=pypcode.TranslateFlags.BB_TERMINATING)
```
This one needs the whole run in a single `translate` call — no individual word
in that sequence crashes on its own, which I checked.
## How much weight to put on these
Less than on the PowerPC report I opened alongside this one, and I would rather
say so than oversell. That case is an ordinary `vaddubm` that a compiler emits,
and it corrupts the heap. These three are short sequences that do not correspond
to code any toolchain produces, so they are robustness findings rather than
something a user meets on real input.
They still seem worth having. A lifter is routinely pointed at binaries whose
provenance is unknown, and there the distinction between "valid code" and
"arbitrary bytes" does not hold — the caller cannot know which it has until
after the lift, and a segfault gives no opportunity to skip the block.
I have not attempted fixes and am not proposing any. Happy to retest against a
patch.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.