Segfault in libcapstone.so.4 after renaming variable in visual mode #15691

DoITCreative · 2019-12-20T12:15:31Z

Work environment

Questions	Answers
OS/arch/bits (mandatory)	ArchLinux x86_64
File format of the file you reverse (mandatory)	ELF
Architecture/bits of the file (mandatory)	x86/32
r2 -v full output, not truncated (mandatory)	radare2 2.4.0-git 17284 @ darwin-x86-64 git.2.2.0-476-gf8cf84e06 commit: `f8cf84e` build: 2018-02-17__11:08:27

Expected behavior

Variable should be renamed

Actual behavior

Segfault

Steps to reproduce

aaa
s <address>
V
<space>
dv <last hex digits of variable>
<enter>

Additional Logs

I've managed to trace the bug to the file:

./libr/core/vmenus.c:4060

Error happens in libcapstone.so.4 when trying to dereference pointer, that points to the address, that is stored in variable try_off on line 4060 in ./libr/core/vmenus.c

Stacktrace

#0  0x00007f57405ededd in ?? () from /usr/lib/libcapstone.so.4
#1  0x00007f57405ec3da in ?? () from /usr/lib/libcapstone.so.4
#2  0x00007f57405ee109 in ?? () from /usr/lib/libcapstone.so.4
#3  0x00007f5740552a86 in cs_disasm () from /usr/lib/libcapstone.so.4
#4  0x00007f5740ba4eb7 in analop (a=0x55b4ca940930, op=0x7ffd83738690, addr=404799108, 
    buf=0x55b4e86abde0 <error: Cannot access memory at address 0x55b4e86abde0>, len=32, 
    mask=<optimized out>) at ../libr/anal/p/anal_x86_cs.c:3001
#5  0x00007f5740c60965 in r_anal_op (anal=0x55b4ca940930, op=op@entry=0x7ffd83738690, 
    addr=addr@entry=404799108, 
    data=0x55b4e86abde0 <error: Cannot access memory at address 0x55b4e86abde0>, 
    len=len@entry=32, mask=mask@entry=R_ANAL_OP_MASK_ALL) at ../libr/anal/op.c:154
#6  0x00007f5740f70ad1 in r_core_visual_define (core=<optimized out>, args=0x7f57410be12c "", 
    distance=0) at ../libr/core/vmenus.c:4060
#7  0x00007f5740f9e9b3 in r_core_visual_graph (core=0x7f5741746340 <r>, g=<optimized out>, 
    _fcn=<optimized out>, is_interactive=<optimized out>) at ../libr/core/agraph.c:4545
#8  0x00007f5740f7986e in r_core_visual_cmd (core=core@entry=0x7f5741746340 <r>, 
    arg=arg@entry=0x7ffd83739c8e " ") at ../libr/core/visual.c:2894
#9  0x00007f5740f7a06f in r_core_visual (core=0x7f5741746340 <r>, input=<optimized out>)
    at ../libr/core/visual.c:4325
#10 0x00007f5740fc7d1a in r_cmd_call (input=0x55b4cda27b50 "V", cmd=0x55b4ca98c120)
    at ../libr/core/cmd_api.c:244
#11 r_cmd_call (cmd=0x55b4ca98c120, input=<optimized out>) at ../libr/core/cmd_api.c:209
#12 0x00007f5740fd3204 in r_core_cmd_subst_i (core=core@entry=0x7f5741746340 <r>, 
    cmd=cmd@entry=0x55b4cda27b50 "V", colon=colon@entry=0x0, 
    tmpseek=tmpseek@entry=0x7ffd83739fd7) at ../libr/core/cmd.c:3148
#13 0x00007f5740fd4d4f in r_core_cmd_subst (core=core@entry=0x7f5741746340 <r>, 
    cmd=<optimized out>, cmd@entry=0x55b4caa48570 "V") at ../libr/core/cmd.c:2467
#14 0x00007f5740fd5318 in r_core_cmd (core=0x7f5741746340 <r>, cstr=<optimized out>, 
    log=<optimized out>) at ../libr/core/cmd.c:4424
#15 0x00007f5740fbfb1c in r_core_prompt_exec (r=r@entry=0x7f5741746340 <r>)
    at ../libr/core/core.c:3102
#16 0x00007f5741735f4a in r_main_radare2 (argc=<optimized out>, argv=<optimized out>)
    at ../libr/main/radare2.c:1463
#17 0x00007f57418b2153 in __libc_start_main () from /usr/lib/libc.so.6
#18 0x000055b4c9dc226e in _start ()

The text was updated successfully, but these errors were encountered:

GustavoLCR · 2019-12-20T14:47:38Z

radare2 2.4 is too old, update and try again please

DoITCreative · 2019-12-20T15:10:42Z

Same error in:
radare2 4.1.1 0 @ linux-x86-64 git.4.1.1
commit: HEAD build: 2019-12-20__18:02:51

Segfault while trying to change name of "dword [var_90h]"

radare · 2019-12-20T19:20:19Z

If u know where the bug is please report in a PR not as an issue

…

On 20 Dec 2019, at 21:15, DoITCreative ***@***.***> wrote: Work environment Questions Answers OS/arch/bits (mandatory) ArchLinux x86_64 File format of the file you reverse (mandatory) ELF Architecture/bits of the file (mandatory) x86/32 r2 -v full output, not truncated (mandatory) radare2 2.4.0-git 17284 @ darwin-x86-64 git.2.2.0-476-gf8cf84e06 commit: f8cf84e build: 2018-02-17__11:08:27 Expected behavior Variable should be renamed Actual behavior Segfault Steps to reproduce aaa s <address> V <space> dv <last hex digits of variable> <enter> Additional Logs I've managed to trace the bug to the file: ./libr/core/vmenus.c:4060 Error happens in libcapstone.so.4 when trying to dereference pointer, that points to the variable try_off on line 4060 in ./libr/core/vmenus.c Stacktrace #0 0x00007f57405ededd in ?? () from /usr/lib/libcapstone.so.4 #1 0x00007f57405ec3da in ?? () from /usr/lib/libcapstone.so.4 #2 0x00007f57405ee109 in ?? () from /usr/lib/libcapstone.so.4 #3 0x00007f5740552a86 in cs_disasm () from /usr/lib/libcapstone.so.4 #4 0x00007f5740ba4eb7 in analop (a=0x55b4ca940930, op=0x7ffd83738690, addr=404799108, buf=0x55b4e86abde0 <error: Cannot access memory at address 0x55b4e86abde0>, len=32, mask=<optimized out>) at ../libr/anal/p/anal_x86_cs.c:3001 #5 0x00007f5740c60965 in r_anal_op (anal=0x55b4ca940930, ***@***.***=0x7ffd83738690, ***@***.***=404799108, data=0x55b4e86abde0 <error: Cannot access memory at address 0x55b4e86abde0>, ***@***.***=32, ***@***.***=R_ANAL_OP_MASK_ALL) at ../libr/anal/op.c:154 #6 0x00007f5740f70ad1 in r_core_visual_define (core=<optimized out>, args=0x7f57410be12c "", distance=0) at ../libr/core/vmenus.c:4060 #7 0x00007f5740f9e9b3 in r_core_visual_graph (core=0x7f5741746340 <r>, g=<optimized out>, _fcn=<optimized out>, is_interactive=<optimized out>) at ../libr/core/agraph.c:4545 #8 0x00007f5740f7986e in r_core_visual_cmd ***@***.***=0x7f5741746340 <r>, ***@***.***=0x7ffd83739c8e " ") at ../libr/core/visual.c:2894 #9 0x00007f5740f7a06f in r_core_visual (core=0x7f5741746340 <r>, input=<optimized out>) at ../libr/core/visual.c:4325 #10 0x00007f5740fc7d1a in r_cmd_call (input=0x55b4cda27b50 "V", cmd=0x55b4ca98c120) at ../libr/core/cmd_api.c:244 #11 r_cmd_call (cmd=0x55b4ca98c120, input=<optimized out>) at ../libr/core/cmd_api.c:209 #12 0x00007f5740fd3204 in r_core_cmd_subst_i ***@***.***=0x7f5741746340 <r>, ***@***.***=0x55b4cda27b50 "V", ***@***.***=0x0, ***@***.***=0x7ffd83739fd7) at ../libr/core/cmd.c:3148 #13 0x00007f5740fd4d4f in r_core_cmd_subst ***@***.***=0x7f5741746340 <r>, cmd=<optimized out>, ***@***.***=0x55b4caa48570 "V") at ../libr/core/cmd.c:2467 #14 0x00007f5740fd5318 in r_core_cmd (core=0x7f5741746340 <r>, cstr=<optimized out>, log=<optimized out>) at ../libr/core/cmd.c:4424 #15 0x00007f5740fbfb1c in r_core_prompt_exec ***@***.***=0x7f5741746340 <r>) at ../libr/core/core.c:3102 #16 0x00007f5741735f4a in r_main_radare2 (argc=<optimized out>, argv=<optimized out>) at ../libr/main/radare2.c:1463 #17 0x00007f57418b2153 in __libc_start_main () from /usr/lib/libc.so.6 #18 0x000055b4c9dc226e in _start () — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or unsubscribe.

DoITCreative · 2019-12-21T06:37:09Z

I do not know how to fix it, so I can't do PR for now.

radare · 2019-12-28T17:45:31Z

can you share the binary?

radare · 2019-12-28T17:52:27Z

also i have the feeling you are not buuilding r2 properly because it should use capstone from git, not the system one by default. and i cant reproduce or see the backtrace of your last build. can you build with asan using sys/asan.sh and paste the output? did you make purged to remove old system wide installations?

DoITCreative · 2019-12-28T17:55:15Z

https://drive.google.com/open?id=18O0gkIsrlooHM5gTHDwHMUju9CeZoNmJ

DoITCreative · 2019-12-28T18:00:28Z

There is no sys/asan.sh in the master branch

DoITCreative · 2019-12-28T18:07:09Z

I've build it with:

./configure
make
sudo make install

radare · 2019-12-28T18:08:08Z

try the following: sudo make purge git clean -xdf sys/install.sh

…

On 28 Dec 2019, at 19:07, DoITCreative ***@***.***> wrote: I've build it with: ./configure make make install — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#15691?email_source=notifications&email_token=AAG75FTLCV37HKA6VBKGCC3Q26IU5A5CNFSM4J55F7P2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEHYPHQA#issuecomment-569439168>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAG75FWPXO5UM7U6HEG3WOTQ26IU5ANCNFSM4J55F7PQ>.

DoITCreative · 2019-12-28T18:12:24Z

Same error.
Steps to reproduce on this binary https://drive.google.com/open?id=18O0gkIsrlooHM5gTHDwHMUju9CeZoNmJ:

aaa
s 0x0820be94
V
space
p
dv 820be84

DoITCreative · 2019-12-28T18:15:22Z

It uses capstone from git

radare · 2019-12-28T18:20:03Z

and the backtrace / crashlog from asan is?

DoITCreative · 2019-12-28T18:30:08Z

Build logs:
logstderr.txt
logstdout.txt

There is no asan.sh file.

DoITCreative · 2019-12-28T19:11:52Z

I guess, that I've found where error is. Look at line 4064 at ./libr/core/vmenus.c
start_off is incorrect, it is being set to 0x1820be84 when I've specify dv 820be84, but it should be 0x0820be84
After that it is assigned to try_off and passed further to r_anal_op (core->anal, &op, try_off,...

DoITCreative · 2019-12-28T19:34:36Z

I've changed start_off to N & mask and it fixed segfault error, but it should be tested on other cases.

DoITCreative · 2019-12-28T20:27:33Z

Also segfaults if incorrect address was set by user.
Same binary:

aaa
s 0x0820be94
V
space
p
dv 820be94

Some checks should be implemented to catch such cases.

DoITCreative · 2019-12-30T15:03:46Z

New PR #15732

DoITCreative · 2019-12-30T16:35:06Z

Yep, it does work, but please, do not forget about incorrect check inside "if" or we will have wrong address at try_off, it does not segfaults now, but variable to rename could not be found, because of incorrect address.

radare added this to the 4.2.0 (Arctic World Archive) milestone Dec 28, 2019

radare added the IMPORTANT label Dec 28, 2019

DoITCreative mentioned this issue Dec 28, 2019

Fix segfault on variable rename #15721

Closed

DoITCreative added a commit to DoITCreative/radare2 that referenced this issue Dec 30, 2019

Fix for issue radareorg#15691

84c9ff3

radare closed this as completed in 34a4c6d Dec 30, 2019

thestr4ng3r added a commit that referenced this issue Dec 30, 2019

Fix #15691 harder

d967e89

radare pushed a commit that referenced this issue Dec 30, 2019

Fix #15691 harder (#15733)

aced45b

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Segfault in libcapstone.so.4 after renaming variable in visual mode #15691

Segfault in libcapstone.so.4 after renaming variable in visual mode #15691

DoITCreative commented Dec 20, 2019 •

edited

Loading

GustavoLCR commented Dec 20, 2019

DoITCreative commented Dec 20, 2019 •

edited

Loading

radare commented Dec 20, 2019 via email

DoITCreative commented Dec 21, 2019

radare commented Dec 28, 2019

radare commented Dec 28, 2019

DoITCreative commented Dec 28, 2019

DoITCreative commented Dec 28, 2019

DoITCreative commented Dec 28, 2019 •

edited

Loading

radare commented Dec 28, 2019 via email

DoITCreative commented Dec 28, 2019 •

edited

Loading

DoITCreative commented Dec 28, 2019

radare commented Dec 28, 2019

DoITCreative commented Dec 28, 2019

DoITCreative commented Dec 28, 2019 •

edited

Loading

DoITCreative commented Dec 28, 2019 •

edited

Loading

DoITCreative commented Dec 28, 2019

DoITCreative commented Dec 30, 2019

DoITCreative commented Dec 30, 2019

Segfault in libcapstone.so.4 after renaming variable in visual mode #15691

Segfault in libcapstone.so.4 after renaming variable in visual mode #15691

Comments

DoITCreative commented Dec 20, 2019 • edited Loading

Work environment

Expected behavior

Actual behavior

Steps to reproduce

Additional Logs

Stacktrace

GustavoLCR commented Dec 20, 2019

DoITCreative commented Dec 20, 2019 • edited Loading

radare commented Dec 20, 2019 via email

DoITCreative commented Dec 21, 2019

radare commented Dec 28, 2019

radare commented Dec 28, 2019

DoITCreative commented Dec 28, 2019

DoITCreative commented Dec 28, 2019

DoITCreative commented Dec 28, 2019 • edited Loading

radare commented Dec 28, 2019 via email

DoITCreative commented Dec 28, 2019 • edited Loading

DoITCreative commented Dec 28, 2019

radare commented Dec 28, 2019

DoITCreative commented Dec 28, 2019

DoITCreative commented Dec 28, 2019 • edited Loading

DoITCreative commented Dec 28, 2019 • edited Loading

DoITCreative commented Dec 28, 2019

DoITCreative commented Dec 30, 2019

DoITCreative commented Dec 30, 2019

DoITCreative commented Dec 20, 2019 •

edited

Loading

DoITCreative commented Dec 20, 2019 •

edited

Loading

DoITCreative commented Dec 28, 2019 •

edited

Loading

DoITCreative commented Dec 28, 2019 •

edited

Loading

DoITCreative commented Dec 28, 2019 •

edited

Loading

DoITCreative commented Dec 28, 2019 •

edited

Loading