mandiant / mandiant/capa

OverflowError:

Open
#2,170 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug ida-explorer
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

via @Ana06

```
ERROR:capa.ida.plugin.form:Failed to extract capabilities from database (error: in method 'get_bytes', argument 2 of type 'unsigned int')
Traceback (most recent call last):
File "C:\Python310\lib\site-packages\capa\ida\plugin\form.py", line 772, in load_capa_results
capabilities, counts = capa.capabilities.common.find_capabilities(
File "C:\Python310\lib\site-packages\capa\capabilities\common.py", line 75, in find_capabilities
return find_static_capabilities(ruleset, extractor, disable_progress=disable_progress, **kwargs)
File "C:\Python310\lib\site-packages\capa\capabilities\static.py", line 213, in find_static_capabilities
all_file_matches, feature_count = find_file_capabilities(ruleset, extractor, function_and_lower_features)
File "C:\Python310\lib\site-packages\capa\capabilities\common.py", line 25, in find_file_capabilities
for feature, va in itertools.chain(extractor.extract_file_features(), extractor.extract_global_features()):
File "C:\Python310\lib\site-packages\capa\features\extractors\ida\extractor.py", line 50, in extract_file_features
yield from capa.features.extractors.ida.file.extract_features()
File "C:\Python310\lib\site-packages\capa\features\extractors\ida\file.py", line 196, in extract_features
for feature, addr in file_handler():
File "C:\Python310\lib\site-packages\capa\features\extractors\ida\file.py", line 152, in extract_file_strings
seg_buff = capa.features.extractors.ida.helpers.get_segment_buffer(seg)
File "C:\Python310\lib\site-packages\capa\features\extractors\ida\helpers.py", line 76, in get_segment_buffer
buff = idaapi.get_bytes(seg.start_ea, sz)
File "C:\Program Files\IDA Pro 8.4\python\3\ida_bytes.py", line 4353, in get_bytes
return _ida_bytes.get_bytes(*args)
OverflowError: in method 'get_bytes', argument 2 of type 'unsigned int'
```

the second arg to `get_bytes` is the size, so capa is trying to read a huge segment, larger than 4GB, and this is failing. we should validate these segment sizes and avoid reading too much data into memory.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in capa/features/extractors/ida/helpers.py at get_segment_buffer, then inspect the callers in capa/features/extractors/ida/file.py, especially extract_file_strings. Reproduce or reason through the oversized segment case from the traceback; done means oversized segments are validated and do not cause get_bytes to request an unsafe size or load excessive data.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.