search

radareorg / radeco

radare2-based decompiler and symbol executor
371 stars 52 forks source link

Assertion failed `(left == right)` during SCCP stage on /bin/ls #251

Open XVilka opened 5 years ago

XVilka commented 5 years ago

image

Here is the /bin/ls binary from Fedora 29 fedora-ls.zip

Mm7 commented 5 years ago

@XVilka @kriw It seems that the issue is within ssaconstructor.rs but I still can't see what is wrong.

I'm not really familiar with the frontend code, can you please look into this bug? Thanks! Here is a minimal code to reproduce the crash (the assembled version is attached to this comment):

hello:  mov rdx, qword [rdi + 8]    ; [0x8:8]=0 ; arg1
    xor eax, eax
    test rdx, rdx
    je out
    nop dword [rax + rax]
loop:   mov rcx, qword [rdx]
    sub rcx, rdx
    mov rdx, qword [rdx + 8]    ; [0x8:8]=0
    add rax, rcx
    test rdx, rdx
    jne loop
    ret
out:    ret

binary.zip

XVilka commented 5 years ago

@Mm7 by the way we have regressions tests for radeco too, see https://github.com/radareorg/radeco-regressions

So you can add binaries/tests here too.

kriw commented 5 years ago

@Mm7 I tried to find the root cause of the bug, but I also can't see what is wrong. It seems that out: ret is not processed properly. This will cause that the destination node of je out is missing. I will continue to try to resolve this issue, thank you.