Issue with soundness of HLIL control flow structuring #5201
Labels
Component: Core
Issue needs changes to the core
Core: HLIL
Issue involves High Level IL
Effort: High
Issue should take > 1 month
Impact: High
Issue adds or blocks important functionality
Type: Bug
Issue is a non-crashing bug with repro steps
Milestone
HLIL can produce unsound control flow structuring in some conditions.
Consider this MLIL code:
orig_state_exec.zip
In MLIL everything looks correct:
Consider the case when 'i = 0
the path means
iis assigned to
5and then ultimately goes to instruction
21`Now in HLIL:
The control flow is a series of
if
statements rather thanif-else
statements. In the case ofi == 0
it meets the first condition and setsi = 5
and then can also satisfy the second condition too incorrectly settingvar_20 = 1
Special Thanks to: Zao Yang and Stefan Nagy for their research in Decompiler Fuzzing for reporting this issue.
The text was updated successfully, but these errors were encountered: