Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Capstone Next Bug in code. modRMRequired has an invalid index read #2365

Open
trile127 opened this issue May 22, 2024 · 0 comments
Open

Capstone Next Bug in code. modRMRequired has an invalid index read #2365

trile127 opened this issue May 22, 2024 · 0 comments
Labels
Milestone

Comments

@trile127
Copy link

trile127 commented May 22, 2024

Work environment

Questions Answers
OS/arch/bits Ubuntu 22.04 64 Bit
Architecture x86
Source of Capstone git clone
Version/git commit next, fe60b13

Expected behavior

no error, or segfault

Actual behavior

Using Valgrind for information
==312219== Invalid read of size 1
==312219== at 0x120CFC: modRMRequired (X86DisassemblerDecoder.c:139)
==312219== by 0x120CFC: getIDWithAttrMask (X86DisassemblerDecoder.c:910)
==312219== by 0x121946: getID (X86DisassemblerDecoder.c:1221)
==312219== by 0x121946: decodeInstruction (X86DisassemblerDecoder.c:2337)
==312219== by 0x1192E7: X86_getInstruction (X86Disassembler.c:982)
==312219== by 0x117950: cs_disasm_iter (cs.c:1408)
==312219== by 0x110DF5: disassemble_symbol_funcs (main.c:711)
==312219== by 0x1122AF: main (main.c:1126)
==312219== Address 0x19 is not stack'd, malloc'd or (recently) free'd

Ends with a segfault

Steps to reproduce the behavior

Run cs_disasm on /usr/bin/Xephyr ".text" section and it will crash after awhile

  • Use code markdown CODE to make your code visible

I take the .text section and just read it in byte by byte, it will error out over time. I've tried cs_disasm_iter and cs_disasm reading in chunks of 4096 at a time.

cs_insn *insn = cs_malloc(handle);
             fflush(stdout);
                while(cs_disasm_iter(handle, &chunk_ptr, &bytesRead, &(sym->st_value), insn)) {
    
                    offset += insn->size;
                    printf("0x%" PRIx64 ": %s %s, insns bytes: ", insn->address, insn->mnemonic, insn->op_str);

                    for (int i = 0; i < insn->size; i++) {
                        printf("%02x ", insn->bytes[i]);
                    }
                 
                    printf("\n");

                }

Also, this errors for v5 as well

@Rot127 Rot127 added bug X86 Arch labels May 24, 2024
@Rot127 Rot127 modified the milestones: v6, v5.0.2 May 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants