OverflowError:
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
via @Ana06
```
ERROR:capa.ida.plugin.form:Failed to extract capabilities from database (error: in method 'get_bytes', argument 2 of type 'unsigned int')
Traceback (most recent call last):
File "C:\Python310\lib\site-packages\capa\ida\plugin\form.py", line 772, in load_capa_results
capabilities, counts = capa.capabilities.common.find_capabilities(
File "C:\Python310\lib\site-packages\capa\capabilities\common.py", line 75, in find_capabilities
return find_static_capabilities(ruleset, extractor, disable_progress=disable_progress, **kwargs)
File "C:\Python310\lib\site-packages\capa\capabilities\static.py", line 213, in find_static_capabilities
all_file_matches, feature_count = find_file_capabilities(ruleset, extractor, function_and_lower_features)
File "C:\Python310\lib\site-packages\capa\capabilities\common.py", line 25, in find_file_capabilities
for feature, va in itertools.chain(extractor.extract_file_features(), extractor.extract_global_features()):
File "C:\Python310\lib\site-packages\capa\features\extractors\ida\extractor.py", line 50, in extract_file_features
yield from capa.features.extractors.ida.file.extract_features()
File "C:\Python310\lib\site-packages\capa\features\extractors\ida\file.py", line 196, in extract_features
for feature, addr in file_handler():
File "C:\Python310\lib\site-packages\capa\features\extractors\ida\file.py", line 152, in extract_file_strings
seg_buff = capa.features.extractors.ida.helpers.get_segment_buffer(seg)
File "C:\Python310\lib\site-packages\capa\features\extractors\ida\helpers.py", line 76, in get_segment_buffer
buff = idaapi.get_bytes(seg.start_ea, sz)
File "C:\Program Files\IDA Pro 8.4\python\3\ida_bytes.py", line 4353, in get_bytes
return _ida_bytes.get_bytes(*args)
OverflowError: in method 'get_bytes', argument 2 of type 'unsigned int'
```
the second arg to `get_bytes` is the size, so capa is trying to read a huge segment, larger than 4GB, and this is failing. we should validate these segment sizes and avoid reading too much data into memory.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in capa/features/extractors/ida/helpers.py at get_segment_buffer, then inspect the callers in capa/features/extractors/ida/file.py, especially extract_file_strings. Reproduce or reason through the oversized segment case from the traceback; done means oversized segments are validated and do not cause get_bytes to request an unsafe size or load excessive data.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100