search

capstone-engine / capstone

Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
http://www.capstone-engine.org
7.5k stars 1.55k forks source link

disassembly fails with double 0x66 prefix #1037

Open dwks opened 6 years ago

dwks commented 6 years ago

Hi,

When disassembling libstdc++.so, I found the following instruction:

66 66 48 e8 dc c8 ff ff    data16 data16 callq ffffffffffffc8e4 <code+0xffffffffffffc8e4>

When I give this instruction to capstone, it thinks it is only 6 (not 8) bytes long. It also enters an error state and keeps disassembling infinitely after that, ignoring my specified code size, until a disassembly error is encountered. Instructions with a single 0x66 prefix work correctly.

On the next branch, the instruction is correctly disassembled but the infinite loop still happens. If I give cs_disasm a fixed maximum number of instructions, it stops at that bound but still overruns my input buffer. The infinite loop doesn't happen if this instruction is not present.

Could this please be fixed and the functionality merged into master, not just next? This is not a particularly exotic instruction.

dwks commented 6 years ago

Here is a reproducible test case: https://github.com/dwks/capstone-666