Skip to content

Fix null dereferences in the dis and pyc disassemblers without a loaded file ##crash - #27139

Merged
trufae merged 1 commit into
radareorg:masterfrom
HuzaifaChaudary:fix-dis-pyc-without-bin
Oct 24, 2026
Merged

trufae merged 1 commit into
radareorg:masterfrom
HuzaifaChaudary:fix-dis-pyc-without-bin

Conversation

@HuzaifaChaudary

@HuzaifaChaudary HuzaifaChaudary commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor
  • Mark this if you consider it ready to merge
  • I've added tests (optional)
  • I wrote some lines in the book (optional)

Description

two disassemblers crash when there is no file behind the bytes , as with rasm2 -d :

$ rasm2 -a dis -b 32 -d 1e2e67cb122a
ERROR: AddressSanitizer: SEGV on unknown address 0x000000000050
    #0 in decode libr/arch/p/dis/plugin.c:305
$ rasm2 -a pyc -d 8eaf2062
ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008
    #0 in pyc_decode libr/arch/p/pyc/plugin.c:170
  • dis only sets o when the dis bin plugin is loaded , but jmp , call and the conditional branches read o->pcs anyway . a small resolve_pc returns UT64_MAX when there is no module , which is what a pc that is not in the table already gave
  • pyc read b->cur with no RBin , that is R_UNWRAP4 now . after that it passed the unset asm.cpu to strcmp in get_opcode_by_version , so with no cpu it takes the same v3.9.0 table an unknown version already falls back to . without the pyc file there are no code objects , so the bytes come out as invalid , as they do inside r2 on a raw buffer

found with an ASan build , disassembling random 1 to 16 byte strings with every plugin rasm2 -L lists that can disassemble , 100 per plugin . these two were the only reports , with the change the same 8500 runs report nothing . the 4 lines in db/asm/dis_32 and db/asm/pyc crash before the change .

Copilot AI balanced review requested due to automatic review settings October 22, 2026 23:24

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@trufae
trufae merged commit 33cb3d4 into radareorg:master Oct 24, 2026
49 of 50 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants