angr / angr/vex

riscv64: shift instructions can behave wrong

Open
#76 5 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
C
Stars
116
Forks
51
Avg merge
16h 20m
Merged PRs (30d)
2

Description

### Description

The RISCV64 ISA specifications say that the shift operations:
- sra, srl, sll use the lowest 6 bits of rd2
- sraw, srlw, sllw use the lowest 5 bits of rd2
as amount to shift by.

(Can be found in the RISCV unprivileged manual, chapter 4.2.1. Integer Register-Immediate Instructions)

In `VEX/priv/guest_riscv64_toIR.c` lines 1536-1586 and lines 1712-1740, these shift instructions are decoded, but the lowest 8 bits of rs2 are taken as parameter for the shift.
This can result in shifts by more than 63 for sra, srl, sll and more than 31 for raw, srlw, sllw.

### Steps to reproduce the bug

reproducer: https://github.com/Cskorpion/angr-shift-reproducer

### Environment

angr environment report
=============================
Date: 2025-09-05 17:26:42.930274
!!! running in global environment. Are you sure? !!!
Platform: linux-x86_64
Python version: 3.11.13 (main, Jun 5 2025, 13:12:00) [GCC 11.2.0]
######## angr #########
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/angr/__init__.py
Pip version 9.2.173
Couldn't find git info
######## ailment #########
An error occurred importing ailment: 'NoneType' object has no attribute 'origin'
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/angr/__init__.py
Pip version not found!
Couldn't find git info
######## cle #########
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/cle/__init__.py
Pip version 9.2.173
Couldn't find git info
######## pyvex #########
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/pyvex/__init__.py
Pip version 9.2.173
Couldn't find git info
######## claripy #########
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/claripy/__init__.py
Pip version 9.2.173
Couldn't find git info
######## archinfo #########
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/archinfo/__init__.py
Pip version 9.2.173
Couldn't find git info
######## z3 #########
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/z3/__init__.py
Pip version 4.13.0.0
Couldn't find git info
######## unicorn #########
An error occurred importing unicorn: 'NoneType' object has no attribute 'origin'
Python found it in /home/christophj/anaconda3/envs/angr2/lib/python3.11/site-packages/z3/__init__.py
Pip version not found!
Couldn't find git info
######### Native Module Info ##########
angr:
unicorn: NOT FOUND
pyvex: .FFILibrary object at 0x7fcda7488c10>
z3:

### Additional context

Bug is also reported at vex https://bugs.kde.org/show_bug.cgi?id=509157

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.