angr / angr/pypcode

Sleigh segfaults on short inputs for JVM, NDS32 and SPARC

Offen
#293 2 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
C++
Sterne
214
Forks
30
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Three Sleigh language definitions segfault on short byte sequences. They are
almost certainly three separate defects and can be split if that is easier to
triage — they are together here because they came out of one survey and share a
shape: a small input, no exception, the process gone.

All three reproduce on `559aacdc`, which is `master` at the time of writing, and
each is a bare `translate` call with no other state.

**1. JVM — `tableswitch`**

```python
pypcode.Context("JVM:BE:32:default").translate(
bytes.fromhex("aa873b8e6f50b409"), 0x1001,
max_instructions=99999, max_bytes=8,
flags=pypcode.TranslateFlags.BB_TERMINATING)
```

`0xaa` is `tableswitch`; `0xab` (`lookupswitch`) fails the same way. Eight bytes.

**2. NDS32**

```python
pypcode.Context("NDS32:LE:32:default").translate(
bytes.fromhex("26095d273add"), 0x1010,
max_instructions=99999, max_bytes=6,
flags=pypcode.TranslateFlags.BB_TERMINATING)
```

Six bytes.

**3. SPARC**

```python
pypcode.Context("sparc:BE:32:default").translate(
bytes.fromhex("1728394a5b6c7d8e9fb0c1d2b01e0019"), 0x14,
max_instructions=99999, max_bytes=16,
flags=pypcode.TranslateFlags.BB_TERMINATING)
```

This one needs the whole run in a single `translate` call — no individual word
in that sequence crashes on its own, which I checked.

## How much weight to put on these

Less than on the PowerPC report I opened alongside this one, and I would rather
say so than oversell. That case is an ordinary `vaddubm` that a compiler emits,
and it corrupts the heap. These three are short sequences that do not correspond
to code any toolchain produces, so they are robustness findings rather than
something a user meets on real input.

They still seem worth having. A lifter is routinely pointed at binaries whose
provenance is unknown, and there the distinction between "valid code" and
"arbitrary bytes" does not hold — the caller cannot know which it has until
after the lift, and a segfault gives no opportunity to skip the block.

I have not attempted fixes and am not proposing any. Happy to retest against a
patch.

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.