NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
50.45k stars 5.77k forks source link

Exception thrown at Structure Editor when inserting size > 1.000.000.000 #5225

Open wichiandyx opened 1 year ago

wichiandyx commented 1 year ago

Describe the bug Exception thrown at Structure Editor when inserting variable that has big size ( > 1.000.000.000 ) image I've got a case where i need to figure out the variables been used at this, so i'm thinking of using Structure Editor to visualize it better To Reproduce Steps to reproduce the behavior:

  1. Go to 'Structure Editor'
  2. Set the size to > 1000000000 or set char[1000000000]
  3. It will throw error like shown below image

Expected behavior If possible, Structure Editor to support a very big structure.

Screenshots I've already included the screenshot above.

Environment (please complete the following information):

astrelsky commented 1 year ago

🤔 I think 1000000000 is a bit too large for a bitfield.

I can't reproduce the error, but it definitely doesn't behave as expected.

wichiandyx commented 1 year ago

🤔 I think 1000000000 is a bit too large for a bitfield.

I can't reproduce the error, but it definitely doesn't behave as expected.

hi astrelsky :D it doesnt throw exception at all? did you used the latest commit?

astrelsky commented 1 year ago

It doesn't throw an exception at all. It just doesn't behave correctly.

wichiandyx commented 1 year ago

Hi @astrelsky ! :D Very weird, i've also tried to compile the latest one (Build DEV 16-April-2023), but it still throws the same exception @.@

ryanmkurtz commented 1 year ago

I've reproduced the exception

astrelsky commented 1 year ago

I've reproduced the exception

I must have immunity somehow. All I see is the editor stop rendering structure components and when I try to close ghidra it gives me the warning about changes or something.

ryanmkurtz commented 1 year ago

I got the exception when converting a byte to an array via the popup where you enter the size.

wichiandyx commented 1 year ago

I hope ghidra could support a big structure, so it could help me with some edge case (like this one) 😄

ghidra1 commented 1 year ago

The composite implementation and associated editor are not designed to scale to this number of components and certainly does not perform well when a very large number of components exist within a composite. We may have to limit the maximum size of a composite as a number of 1-byte components to avoid unintended use such as this.

wichiandyx commented 1 year ago

The composite implementation and associated editor are not designed to scale to this number of components and certainly does not perform well when a very large number of components exist within a composite. We may have to limit the maximum size of a composite as a number of 1-byte components to avoid unintended use such as this.

ah i see, i just wanted to visualize the usage of this big char array in global (as I saw this array been used as a substitute for multiple variant structs, quite evil indeed), it's just hard to keep track of it as is, maybe i should look for workaround 😵

ghidra1 commented 1 year ago

In addition to the composite performance, the BitFieldEditorPanel and BitFieldPlacementComponent need to be refactored to adopt some additional scaling to handle extremely large structures. In the absence of scaling, limits would need to be imposed which would prevent rendering and use of this bit-level view to avoid errors and unexpected behavior.

ghidra1 commented 1 month ago

This may be fixed by commit 02b0dfe which will soon be pushed.

ghidra1 commented 1 month ago

Sorry, apparently it is not fixed by this latest change.