From cbc66f931da1046b3980c2c7c6b64c2f2ac358e2 Mon Sep 17 00:00:00 2001 From: Mark Rowe Date: Wed, 18 Mar 2026 22:58:20 -0700 Subject: Fix operand list iterators being validated when appending new instructions The iterators now store an offset into the operand storage, rather than a pointer. Deferencing the iterator retrieves the value at that offset from the IL function. This issue existed prior to the operand list storage refactor, but became easier to hit after that change. The separate operand list vector is smaller and thus more likely to reallocate when a new instruction is appended. --- mediumlevelilinstruction.cpp | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) (limited to 'mediumlevelilinstruction.cpp') diff --git a/mediumlevelilinstruction.cpp b/mediumlevelilinstruction.cpp index c7dc7a5a..0c89ace3 100644 --- a/mediumlevelilinstruction.cpp +++ b/mediumlevelilinstruction.cpp @@ -320,14 +320,18 @@ bool MediumLevelILIntegerList::ListIterator::operator<(const ListIterator& a) co MediumLevelILIntegerList::ListIterator& MediumLevelILIntegerList::ListIterator::operator++() { count--; - cur++; + offset++; return *this; } uint64_t MediumLevelILIntegerList::ListIterator::operator*() { - return *cur; +#ifdef BINARYNINJACORE_LIBRARY + return function->GetOperand(offset); +#else + return BNMediumLevelILGetOperand(function->GetObject(), offset); +#endif } @@ -335,11 +339,7 @@ MediumLevelILIntegerList::MediumLevelILIntegerList( MediumLevelILFunction* func, size_t offset, size_t count) { m_start.function = func; -#ifdef BINARYNINJACORE_LIBRARY - m_start.cur = func->GetOperandPointer(offset); -#else - m_start.cur = BNMediumLevelILGetOperandPointer(func->GetObject(), offset); -#endif + m_start.offset = offset; m_start.count = count; } @@ -354,7 +354,7 @@ MediumLevelILIntegerList::const_iterator MediumLevelILIntegerList::end() const { const_iterator result; result.function = m_start.function; - result.cur = m_start.cur + m_start.count; + result.offset = m_start.offset + m_start.count; result.count = 0; return result; } @@ -370,7 +370,11 @@ uint64_t MediumLevelILIntegerList::operator[](size_t i) const { if (i >= size()) throw MediumLevelILInstructionAccessException(); - return m_start.cur[i]; +#ifdef BINARYNINJACORE_LIBRARY + return m_start.function->GetOperand(m_start.offset + i); +#else + return BNMediumLevelILGetOperand(m_start.function->GetObject(), m_start.offset + i); +#endif } -- cgit v1.3.1