Skip to content

Type editor accepts invalid struct syntax, hits RecursionError on valid syntax #1512

@zolutal

Description

@zolutal

Description

Creating a struct in the struct view that does not terminate in a semicolon, e.g., struct meow {}, is invalid C syntax but is accepted by the editor.

After creating a struct that correctly terminates in a semicolon, the type editor gets really buggy and starts spewing max recursion depth errors, resulting in the type editor becoming unusable.

Steps to reproduce the bug

Doesn't seem to depend on the binary, I tried it on two random ctf pwn binaries and it happened on both.

Steps:

  1. Open Type View
  2. Click Add Type
  3. In type window create a struct that terminates in a semicolon, e.g., struct wawa {}; and click 'OK'
  4. Click Add Type again, create a second struct that terminates in a semicolon, and click 'OK'

The Types View will now be broken and no longer display types, a max recursion depth error will show in the logs, further interactions with the view will cause more recursion depth errors.

Environment

Ubuntu 22.04, Python 3.10.12

$  pip freeze | grep "\-e"
-e /home/jmill/install/angr-dev/ailment
-e git+https://github.com/angr/angr.git@8993ee36393681e42261a2c59900b44ff5b032d7#egg=angr
-e git+https://github.com/angr/angr-management.git@8341aebaee42316a478b4cde800b4d14f91ba2fa#egg=angr_management
-e git+https://github.com/angr/archinfo.git@3230e8f1fa5cafc293dbfcdb898685d278affdb4#egg=archinfo
-e /home/jmill/install/angr-dev/archr
-e git+https://github.com/angr/claripy.git@ad0a86d9f6577c80d1538d9f2212f9aa11ade95e#egg=claripy
-e git+https://github.com/angr/cle.git@2505db78b704f2f3ee42c5edc76325a41ad47459#egg=cle
-e git+https://github.com/angr/pyvex.git@d732a5624a01551ed97da8c3fff9d95c9d1acf39#egg=pyvex

Additional context

I spent a little time trying to figure out what was going on, it seems like terminating a struct with a semicolon is converting all previously defined structs into TypeRefs that I think reference themselves. The max recursion depth gets hit while trying to get the c_repr for one of the defined struct types:

Traceback (most recent call last):
  File "/home/jmill/install/angr-dev/angr/angr/sim_type.py", line 290, in c_repr
    return self.type.c_repr(name=name, full=full, memo=memo, indent=indent)
  File "/home/jmill/install/angr-dev/angr/angr/sim_type.py", line 290, in c_repr
    return self.type.c_repr(name=name, full=full, memo=memo, indent=indent)
  File "/home/jmill/install/angr-dev/angr/angr/sim_type.py", line 290, in c_repr
    return self.type.c_repr(name=name, full=full, memo=memo, indent=indent)
  [Previous line repeated 996 more times]
  File "/home/jmill/install/angr-dev/angr/angr/sim_type.py", line 285, in c_repr
    print(name, full)
RecursionError: maximum recursion depth exceeded while calling a Python object

When structs are not terminated with semicolons an exception is raised by sim_type.parse_file in CTypeEditor._evaluate, and they get parsed by sim_type.parse_type_with_name instead (which bizarrely accepts structs without trailing semicolons even though parse_file does not?).

I think the logic related to the sim_type.parse_file path is likely causing this error, maybe some interaction between that and the _on_new_type function of the TypesView class where it constructs a TypeRef?

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugneeds-triageIssue has yet to be looked at by a maintainer

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions