Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix a Segfault during aaft #19178

Closed
wants to merge 2 commits into from
Closed

Fix a Segfault during aaft #19178

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7d53e0a
Add a test case
thymol0 Oct 7, 2021
24cadfa
Fix a Segfault during aaft
thymol0 Oct 6, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 2 additions & 2 deletions libr/core/anal_tp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -450,7 +450,7 @@ static int bb_cmpaddr(const void *_a, const void *_b) {

R_API void r_core_anal_type_match(RCore *core, RAnalFunction *fcn) {
RAnalBlock *bb;
RListIter *it;
RListIter *it, *tmp;
RAnalOp aop = {0};
bool resolved = false;

Expand Down Expand Up @@ -516,7 +516,7 @@ R_API void r_core_anal_type_match(RCore *core, RAnalFunction *fcn) {
}
r_cons_break_push (NULL, NULL);
r_list_sort (fcn->bbs, bb_cmpaddr); // TODO: The algorithm can be more accurate if blocks are followed by their jmp/fail, not just by address
r_list_foreach (fcn->bbs, it, bb) {
r_list_foreach_safe (fcn->bbs, it, tmp, bb) {
ut64 addr = bb->addr;
int i = 0;
r_reg_set_value (core->dbg->reg, r, addr);
Expand Down
17 changes: 17 additions & 0 deletions test/db/anal/x86_64
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4096,3 +4096,20 @@ address size nbbs edges cc cost min bound range max boun
0x0000000000000003 9 3 3 0 4 0x0000000000000000 7 0x0000000000000007 0 0 0 0 0 fcn.00000003
EOF
RUN

NAME=Use after free segfault in aft
FILE=-
CMDS=<<EOF
e asm.arch=x86
e asm.bits=64
e bin.cache=1
e anal.detectwrites=1
s 0x0
f func
wx 7f454c4602010100000000000000000003003e0001000000f0040000000000004000000000000000e0180000000000000000000040003800090040001c001b000600000004000000400000000000000040000000000000004000000000000000f801000000000000f801000000000000080000000000000003
af
aeim
aft
EOF
EXPECT=
RUN