Skip to content

Commit

Permalink
[RZIL] Fix reachable endless loop. (#3940)
Browse files Browse the repository at this point in the history
* Fix reachable endless loop.

If rz_il_evaluate_effect() fails to execute it returns false and expects
that the execution is terminated.
Because res was never checked for false, repeat kept going endlessly
in such a case.

* Add unit test for endless loop in case of malformed effect.
  • Loading branch information
Rot127 authored Oct 26, 2023
1 parent b16471f commit c5a29e1
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 1 deletion.
5 changes: 4 additions & 1 deletion librz/il/theory_effect.c
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,10 @@ bool rz_il_handler_repeat(RzILVM *vm, RzILOpEffect *op) {
if (!condition->b) {
break;
}
res = res && rz_il_evaluate_effect(vm, op_repeat->data_eff);
if (!rz_il_evaluate_effect(vm, op_repeat->data_eff)) {
res = false;
break;
}
rz_il_bool_free(condition);
}
rz_il_bool_free(condition);
Expand Down
12 changes: 12 additions & 0 deletions test/unit/test_il_validate.c
Original file line number Diff line number Diff line change
Expand Up @@ -1086,6 +1086,18 @@ static bool test_il_validate_effect_repeat() {
mu_assert_streq_free(report, "Body operand of repeat op does not only perform data effects.", "report");
rz_il_op_effect_free(op);

//////////////////////////
// malformed effect handling

op = rz_il_op_new_seqn(2,
rz_il_op_new_set("x", true, rz_il_op_new_bitv_from_ut64(32, 1)),
rz_il_op_new_repeat(rz_il_op_new_non_zero(rz_il_op_new_var("x", RZ_IL_VAR_KIND_LOCAL)),
rz_il_op_new_set("x", true, rz_il_op_new_sub(rz_il_op_new_var("x", RZ_IL_VAR_KIND_LOCAL), rz_il_op_new_b1()))));
val = rz_il_validate_effect(op, ctx, &local_var_sorts, &t, &report);
mu_assert_false(val, "invalid");
mu_assert_streq_free(report, "Right operand of sub op is not a bitvector.", "report");
rz_il_op_effect_free(op);

rz_il_validate_global_context_free(ctx);
mu_end;
}
Expand Down

0 comments on commit c5a29e1

Please sign in to comment.