Closed rshariffdeen closed 1 year ago
I'm trying to reproduce this one at the moment. Just a heads up that I've been stuck at the following stage in the analysis for roughly 10 minutes so far:
Running Concolic Execution
------------------------------------------------------------------------------------------
Using Arguments: ['-A', '-a', '-l', '-S', '-s', '--special-syms', '--synthetic', '--with-symbol-versions', '-D', '$POC']
Using Input File: /CrashRepair/experiments/vulnloc/binutils/CVE-2017-15025/tests/1.bin
building program
setting environment variables
cleaning files
configuring program
compiling program
extracting bytecode
generating ktest file
executing klee in concolic mode
Edit: It's still stuck on this step after 25 minutes.
This turned out to be the same problem as #54 (notice /src/bfd/./dwarf2.c
) and is now fixed by 44117a4f491cfe9a933858035edcfa35fcb38bb4. Patch evaluation times are awful for binutils, so fixing #74 would make it much easier to run this scenario.
@ChrisTimperley : Repair generates patch that removes case statement and replace with if condition, when it should be inserting the if condition after the case statement. Resulting in zero plausible patches in commit 315b4e2
{
"diff": "@@ -2436,7 +2436,7 @@\n \t break;\n \t case DW_LNS_set_basic_block:\n \t break;\n-\t case DW_LNS_const_add_pc:\n+\t if (!((lh.line_range != $
"id": 0,
"location": "/data/vulnloc/binutils/CVE-2017-15025/src/bfd/dwarf2.c:2439:6",
"operator": "insert-conditional-control-flow",
"replacements": [
{
"filename": "dwarf2.c",
"length": 0,
"offset": 69003,
"text": "if (!((lh.line_range != 0))) { return NULL; } "
}
]
},
@rshariffdeen the analysis stage now crashes for this bug when using the latest changes:
[fix-loc] decode_line_info, /data/vulnloc/binutils/CVE-2017-15025/src/bfd/./dwarf2.c:2442:34
Localizing Constraints
__________________________________________________________________________________________
Unable to Localize a Crash Free Constraint
Repair Failed
Analysis Failed
Runtime Error
Error. Exiting...
Run time statistics:
-----------------------
Startup: 0.000 minutes
Build: 0 minutes
Concrete Analysis: 1.144 minutes
Concolic Analysis: 20.646 minutes
Total Analysis: 21.830 minutes
Localization: 0 minutes
CRepair exited with an error after 34.512 minutes
Moved discussion of underlying issue to #107. Note that this scenario now produces plausible patches.
Repair module doesn't generate any candidates and failed to find the top-location for suggested fix-locations