{"action":"created","issue":{"url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/558","repository_url":"https://api.github.com/repos/unicorn-engine/unicorn","labels_url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/558/labels{/name}","comments_url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/558/comments","events_url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/558/events","html_url":"https://github.com/unicorn-engine/unicorn/issues/558","id":157266379,"number":558,"title":"raise_exception_err segfaults on longjmp under python bindings","user":{"login":"rhelmot","id":2498805,"avatar_url":"https://avatars.githubusercontent.com/u/2498805?v=3","gravatar_id":"","url":"https://api.github.com/users/rhelmot","html_url":"https://github.com/rhelmot","followers_url":"https://api.github.com/users/rhelmot/followers","following_url":"https://api.github.com/users/rhelmot/following{/other_user}","gists_url":"https://api.github.com/users/rhelmot/gists{/gist_id}","starred_url":"https://api.github.com/users/rhelmot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhelmot/subscriptions","organizations_url":"https://api.github.com/users/rhelmot/orgs","repos_url":"https://api.github.com/users/rhelmot/repos","events_url":"https://api.github.com/users/rhelmot/events{/privacy}","received_events_url":"https://api.github.com/users/rhelmot/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-27T18:35:23Z","updated_at":"2016-05-27T21:22:34Z","closed_at":null,"body":"Every time unicorn has segfaulted for me so far, the backtrace has started in `__longjmp` and come up to a call to `raise_exception_err`.\r\n\r\nTo reproduce:\r\n\r\n```python\r\nimport unicorn\r\nuc = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_32)\r\nuc.reg_write(unicorn.x86_const.UC_X86_REG_FS, 0x41414141)  # bad\r\n```\r\n\r\nBacktrace (gdb loses the ability to follow the backtrace once it segfaults, so you gotta set a breakpoint on longjmp itself):\r\n\r\n```\r\n(gdb) bt\r\n#0  __longjmp () at ../sysdeps/x86_64/__longjmp.S:29\r\n#1  0x00007ffff7826279 in __libc_siglongjmp (env=0xb24610, val=1) at longjmp.c:38\r\n#2  0x00007ffff4a0e5e3 in cpu_loop_exit_x86_64 (cpu=0xb24550)\r\n    at /home/andrew/proj/seclab/binary/simuvex/unicorn-master/qemu/cpu-exec.c:36\r\n#3  0x00007ffff49a217c in raise_interrupt2 (env=0xb2c780, intno=13, is_int=0, error_code=16640,\r\n    next_eip_addend=0)\r\n    at /home/andrew/proj/seclab/binary/simuvex/unicorn-master/qemu/target-i386/excp_helper.c:113\r\n#4  0x00007ffff49a21e1 in raise_exception_err (env=0xb2c780, exception_index=13, error_code=16640)\r\n    at /home/andrew/proj/seclab/binary/simuvex/unicorn-master/qemu/target-i386/excp_helper.c:127\r\n#5  0x00007ffff4999194 in helper_load_seg (env=0xb2c780, seg_reg=4, selector=16640)\r\n    at /home/andrew/proj/seclab/binary/simuvex/unicorn-master/qemu/target-i386/seg_helper.c:1570\r\n#6  0x00007ffff499bf29 in cpu_x86_load_seg (env=0xb2c780, seg_reg=4, selector=16640)\r\n    at /home/andrew/proj/seclab/binary/simuvex/unicorn-master/qemu/target-i386/seg_helper.c:2569\r\n#7  0x00007ffff49a65d2 in x86_reg_write (uc=0xadae80, regs=0x7fffffffd864, vals=0x7fffffffd858, count=1)\r\n    at /home/andrew/proj/seclab/binary/simuvex/unicorn-master/qemu/target-i386/unicorn.c:806\r\n#8  0x00007ffff4ff74a2 in uc_reg_write_batch (uc=0xadae80, ids=0x7fffffffd864, vals=0x7fffffffd858,\r\n    count=1) at ../uc.c:343\r\n#9  0x00007ffff4ff750a in uc_reg_write (uc=0xadae80, regid=32, value=0x7ffff544a0a0) at ../uc.c:361\r\n#10 0x00007ffff5d2be40 in ffi_call_unix64 () from /usr/lib/x86_64-linux-gnu/libffi.so.6\r\n#11 0x00007ffff5d2b8ab in ffi_call () from /usr/lib/x86_64-linux-gnu/libffi.so.6\r\n#12 0x00007ffff5f3b3df in _ctypes_callproc ()\r\n   from /home/andrew/.virtualenvs/angr/lib/python2.7/lib-dynload/_ctypes.x86_64-linux-gnu.so\r\n#13 0x00007ffff5f3fd82 in ?? ()\r\n   from /home/andrew/.virtualenvs/angr/lib/python2.7/lib-dynload/_ctypes.x86_64-linux-gnu.so\r\n#14 0x00000000004b1153 in PyObject_Call ()\r\n#15 0x00000000004ca5ca in PyEval_EvalFrameEx ()\r\n#16 0x00000000004ca39f in PyEval_EvalFrameEx ()\r\n#17 0x00000000004c2e05 in PyEval_EvalCodeEx ()\r\n#18 0x00000000004c2ba9 in PyEval_EvalCode ()\r\n#19 0x00000000004f20ef in ?? ()\r\n#20 0x000000000044b9f0 in PyRun_InteractiveOneFlags ()\r\n#21 0x000000000044b830 in PyRun_InteractiveLoopFlags ()\r\n#22 0x000000000042e3a3 in ?? ()\r\n#23 0x000000000049e18a in Py_Main ()\r\n#24 0x00007ffff7811830 in __libc_start_main (main=0x49daf0 <main>, argc=1, argv=0x7fffffffe268,\r\n```"},"comment":{"url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/comments/222256063","html_url":"https://github.com/unicorn-engine/unicorn/issues/558#issuecomment-222256063","issue_url":"https://api.github.com/repos/unicorn-engine/unicorn/issues/558","id":222256063,"user":{"login":"rhelmot","id":2498805,"avatar_url":"https://avatars.githubusercontent.com/u/2498805?v=3","gravatar_id":"","url":"https://api.github.com/users/rhelmot","html_url":"https://github.com/rhelmot","followers_url":"https://api.github.com/users/rhelmot/followers","following_url":"https://api.github.com/users/rhelmot/following{/other_user}","gists_url":"https://api.github.com/users/rhelmot/gists{/gist_id}","starred_url":"https://api.github.com/users/rhelmot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhelmot/subscriptions","organizations_url":"https://api.github.com/users/rhelmot/orgs","repos_url":"https://api.github.com/users/rhelmot/repos","events_url":"https://api.github.com/users/rhelmot/events{/privacy}","received_events_url":"https://api.github.com/users/rhelmot/received_events","type":"User","site_admin":false},"created_at":"2016-05-27T21:22:34Z","updated_at":"2016-05-27T21:22:34Z","body":"looks to be the same crash as #550, which I missed somehow. There's some sort of initialization bug or maybe a corruption bug that prevents the longjmp for exception handling from working correctly."}}
{"actor":{"display_login":"rhelmot"}}