riscv64: shift instructions can behave wrong
- Dominant language
- C
- Stars
- 116
- Forks
- 51
- Avg merge
- 16h 20m
- Merged PRs (30d)
- 2
Description
### Description
The RISCV64 ISA specifications say that the shift operations:
- sra, srl, sll use the lowest 6 bits of rd2
- sraw, srlw, sllw use the lowest 5 bits of rd2
as amount to shift by.
(Can be found in the RISCV unprivileged manual, chapter 4.2.1. Integer Register-Immediate Instructions)
In `VEX/priv/guest_riscv64_toIR.c` lines 1536-1586 and lines 1712-1740, these shift instructions are decoded, but the lowest 8 bits of rs2 are taken as parameter for the shift.
This can result in shifts by more than 63 for sra, srl, sll and more than 31 for raw, srlw, sllw.
### Steps to reproduce the bug
reproducer: https://github.com/Cskorpion/angr-shift-reproducer
### Environment
angr environment report
=============================
Date: 2025-09-05 17:26:42.930274
!!! running in global environment. Are you sure? !!!
Platform: linux-x86_64
Python version: 3.11.13 (main, Jun 5 2025, 13:12:00) [GCC 11.2.0]
######## angr #########
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/angr/__init__.py
Pip version 9.2.173
Couldn't find git info
######## ailment #########
An error occurred importing ailment: 'NoneType' object has no attribute 'origin'
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/angr/__init__.py
Pip version not found!
Couldn't find git info
######## cle #########
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/cle/__init__.py
Pip version 9.2.173
Couldn't find git info
######## pyvex #########
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/pyvex/__init__.py
Pip version 9.2.173
Couldn't find git info
######## claripy #########
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/claripy/__init__.py
Pip version 9.2.173
Couldn't find git info
######## archinfo #########
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/archinfo/__init__.py
Pip version 9.2.173
Couldn't find git info
######## z3 #########
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/z3/__init__.py
Pip version 4.13.0.0
Couldn't find git info
######## unicorn #########
An error occurred importing unicorn: 'NoneType' object has no attribute 'origin'
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/z3/__init__.py
Pip version not found!
Couldn't find git info
######### Native Module Info ##########
angr:
unicorn: NOT FOUND
pyvex: .FFILibrary object at 0x7fcda7488c10>
z3:
### Additional context
Bug is also reported at vex https://bugs.kde.org/show_bug.cgi?id=509157
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.