Fix segfault when a delay-slot instruction has no p-code - #288
Open
zardus wants to merge 1 commit into
Open
Conversation
Member
Author
|
THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS Validation record for head
Caveats, one line each:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #288 +/- ##
=======================================
Coverage 86.82% 86.82%
=======================================
Files 5 5
Lines 516 516
Branches 82 82
=======================================
Hits 448 448
Misses 26 26
Partials 42 42 ☔ View full report in Codecov by Harness. |
SleighBuilder::delaySlot points the builder at a ParserWalker on its own
stack frame and puts the previous one back only on the normal exit path.
When the delay-slot instruction has no p-code section, PcodeBuilder::build
throws UnimplError, the walker is destroyed with the frame, and the
builder is left holding that address. Sleigh::oneInstruction catches the
exception and describes it through exactly that pointer, reading a
ParserContext out of stack the handler has already reused, so
Context.translate segfaults on any delay-slot branch followed by an
instruction with no semantics. Eight bytes of SPARC are enough:
Context("sparc:BE:32:default").translate(bytes.fromhex("63748596a7b8c9da"))
SleighBuilder::appendCrossBuild saves and restores the walker the same
unguarded way around a build() that can throw.
Restore both through a scope object so an exception leaving either method
cannot outlive the walker it installed. The reported instruction is now
the branch rather than its delay slot, which matches the instruction
length UnimplError already carries.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
zardus
force-pushed
the
feature/fix-pypcode-delayslot-uaf
branch
from
August 9, 2026 22:47
40c3774 to
2bbb34d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS
Context.translatesegfaults on a delay-slot branch whose delay slot has no p-code.SleighBuilder::delaySlotpoints the builder at aParserWalkeron its own stack frame and puts the previous one back only on normal exit, so theUnimplErrorraised for the empty delay slot leaves the builder holding a destroyed walker thatSleigh::oneInstructionthen reads to describe the error.delaySlotandappendCrossBuildnow restore through a scope object, so an exception cannot outlive the walker it installed. The error names the branch rather than its delay slot, matching the instruction length it already carries. The vendored code still matches Ghidra master, so the defect is upstream too.The regression translates a call followed by an unimplemented instruction on sparc and Toy; both segfault on master.
Validation: #288 (comment)