From 06611c17ae5ee5936889ff029cac042fdba8a0c5 Mon Sep 17 00:00:00 2001 From: Brandon Miller Date: Tue, 19 May 2026 15:38:42 -0400 Subject: Fix Thumb-2 out-of-bounds read during lifting Fix for sentry crash BINARYNINJA-89 --- defaultarch.cpp | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) (limited to 'defaultarch.cpp') diff --git a/defaultarch.cpp b/defaultarch.cpp index 0c1178b4..cd87f620 100644 --- a/defaultarch.cpp +++ b/defaultarch.cpp @@ -796,16 +796,24 @@ bool Architecture::DefaultLiftFunction(LowLevelILFunction* function, FunctionLif if (buffer.GetLength() == 0) buffer = data->ReadBuffer(i->GetStart(), i->GetEnd() - i->GetStart()); - if (addr < i->GetStart() || addr >= (i->GetStart() + buffer.GetLength())) + uint64_t blockStart = i->GetStart(); + size_t bufferLen = buffer.GetLength(); + if (addr < blockStart || (addr - blockStart) >= bufferLen) { - // Instruction data not found, emit undefined IL instruction function->AddInstruction(function->AddExpr(LLIL_UNDEF, 0, 0)); logger->LogDebug("Instruction data not found, inserted LLIL_UNDEF at %#" PRIx64, addr); break; } - len = (i->GetStart() + buffer.GetLength()) - addr; - opcode = (const uint8_t*)buffer.GetDataAt(addr - i->GetStart()); + size_t bufferOffset = static_cast(addr - blockStart); + len = bufferLen - bufferOffset; + opcode = (const uint8_t*)buffer.GetDataAt(bufferOffset); + if (!opcode) + { + function->AddInstruction(function->AddExpr(LLIL_UNDEF, 0, 0)); + logger->LogDebug("Instruction data not found, inserted LLIL_UNDEF at %#" PRIx64, addr); + break; + } } size_t instrCountBefore = function->GetInstructionCount(); -- cgit v1.3.1