-
Notifications
You must be signed in to change notification settings - Fork 119
Description
Description
Creating a struct in the struct view that does not terminate in a semicolon, e.g., struct meow {}, is invalid C syntax but is accepted by the editor.
After creating a struct that correctly terminates in a semicolon, the type editor gets really buggy and starts spewing max recursion depth errors, resulting in the type editor becoming unusable.
Steps to reproduce the bug
Doesn't seem to depend on the binary, I tried it on two random ctf pwn binaries and it happened on both.
Steps:
- Open Type View
- Click Add Type
- In type window create a struct that terminates in a semicolon, e.g.,
struct wawa {};and click 'OK' - Click Add Type again, create a second struct that terminates in a semicolon, and click 'OK'
The Types View will now be broken and no longer display types, a max recursion depth error will show in the logs, further interactions with the view will cause more recursion depth errors.
Environment
Ubuntu 22.04, Python 3.10.12
$ pip freeze | grep "\-e"
-e /home/jmill/install/angr-dev/ailment
-e git+https://github.com/angr/angr.git@8993ee36393681e42261a2c59900b44ff5b032d7#egg=angr
-e git+https://github.com/angr/angr-management.git@8341aebaee42316a478b4cde800b4d14f91ba2fa#egg=angr_management
-e git+https://github.com/angr/archinfo.git@3230e8f1fa5cafc293dbfcdb898685d278affdb4#egg=archinfo
-e /home/jmill/install/angr-dev/archr
-e git+https://github.com/angr/claripy.git@ad0a86d9f6577c80d1538d9f2212f9aa11ade95e#egg=claripy
-e git+https://github.com/angr/cle.git@2505db78b704f2f3ee42c5edc76325a41ad47459#egg=cle
-e git+https://github.com/angr/pyvex.git@d732a5624a01551ed97da8c3fff9d95c9d1acf39#egg=pyvex
Additional context
I spent a little time trying to figure out what was going on, it seems like terminating a struct with a semicolon is converting all previously defined structs into TypeRefs that I think reference themselves. The max recursion depth gets hit while trying to get the c_repr for one of the defined struct types:
Traceback (most recent call last):
File "/home/jmill/install/angr-dev/angr/angr/sim_type.py", line 290, in c_repr
return self.type.c_repr(name=name, full=full, memo=memo, indent=indent)
File "/home/jmill/install/angr-dev/angr/angr/sim_type.py", line 290, in c_repr
return self.type.c_repr(name=name, full=full, memo=memo, indent=indent)
File "/home/jmill/install/angr-dev/angr/angr/sim_type.py", line 290, in c_repr
return self.type.c_repr(name=name, full=full, memo=memo, indent=indent)
[Previous line repeated 996 more times]
File "/home/jmill/install/angr-dev/angr/angr/sim_type.py", line 285, in c_repr
print(name, full)
RecursionError: maximum recursion depth exceeded while calling a Python object
When structs are not terminated with semicolons an exception is raised by sim_type.parse_file in CTypeEditor._evaluate, and they get parsed by sim_type.parse_type_with_name instead (which bizarrely accepts structs without trailing semicolons even though parse_file does not?).
I think the logic related to the sim_type.parse_file path is likely causing this error, maybe some interaction between that and the _on_new_type function of the TypesView class where it constructs a TypeRef?