angr / angr/pypcode

Sleigh segfaults on short inputs for JVM, NDS32 and SPARC

Open
#293 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
214
Forks
30
PR merge metrics
No merged PRs in 30d

Description

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Three Sleigh language definitions segfault on short byte sequences. They are
almost certainly three separate defects and can be split if that is easier to
triage — they are together here because they came out of one survey and share a
shape: a small input, no exception, the process gone.

All three reproduce on `559aacdc`, which is `master` at the time of writing, and
each is a bare `translate` call with no other state.

**1. JVM — `tableswitch`**

```python
pypcode.Context("JVM:BE:32:default").translate(
bytes.fromhex("aa873b8e6f50b409"), 0x1001,
max_instructions=99999, max_bytes=8,
flags=pypcode.TranslateFlags.BB_TERMINATING)
```

`0xaa` is `tableswitch`; `0xab` (`lookupswitch`) fails the same way. Eight bytes.

**2. NDS32**

```python
pypcode.Context("NDS32:LE:32:default").translate(
bytes.fromhex("26095d273add"), 0x1010,
max_instructions=99999, max_bytes=6,
flags=pypcode.TranslateFlags.BB_TERMINATING)
```

Six bytes.

**3. SPARC**

```python
pypcode.Context("sparc:BE:32:default").translate(
bytes.fromhex("1728394a5b6c7d8e9fb0c1d2b01e0019"), 0x14,
max_instructions=99999, max_bytes=16,
flags=pypcode.TranslateFlags.BB_TERMINATING)
```

This one needs the whole run in a single `translate` call — no individual word
in that sequence crashes on its own, which I checked.

## How much weight to put on these

Less than on the PowerPC report I opened alongside this one, and I would rather
say so than oversell. That case is an ordinary `vaddubm` that a compiler emits,
and it corrupts the heap. These three are short sequences that do not correspond
to code any toolchain produces, so they are robustness findings rather than
something a user meets on real input.

They still seem worth having. A lifter is routinely pointed at binaries whose
provenance is unknown, and there the distinction between "valid code" and
"arbitrary bytes" does not hold — the caller cannot know which it has until
after the lift, and a segfault gives no opportunity to skip the block.

I have not attempted fixes and am not proposing any. Happy to retest against a
patch.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.