Skip to content

Don't overflow the bit buffer printing Cd data in binary ##crash - #27322

Merged
trufae merged 1 commit into
radareorg:masterfrom
Thanatos9404:data-binary-bits
Nov 3, 2026
Merged

trufae merged 1 commit into
radareorg:masterfrom
Thanatos9404:data-binary-bits

Conversation

@Thanatos9404

Copy link
Copy Markdown
Contributor
  • Mark this if you consider it ready to merge
  • I've added tests (optional)
  • I wrote some lines in the book (optional)

Description

With a binary immbase (ahi 1), ds_print_data_type prints a Cd item bit by bit with r_str_bits (msg, buf, size * 8, NULL). msg was char msg[64], and buf only holds the first 8 bytes of the item:

  • for an 8-byte item, the 64 bits plus the NUL wrote one byte past msg;
  • for a 31-byte item (.smi), it wrote 249 bytes into msg and read 31 bytes from the 8-byte buf. wx 0102030405060708; Cd 31; ahi 1; pd 1 aborts with *** stack smashing detected ***.

msg now holds 64 bits plus the NUL. Items larger than 8 bytes fall back to the hexdump, which is what pd already shows for Cd 31 without the hint.

#27320 moves this code into a helper. I'll rebase whichever of the two lands second.

Testing

  • Two tests in test/db/cmd/metadata:

    • an 8-byte item in binary, printing all 64 bits;
    • a 31-byte item, falling back to the hexdump. It crashes on master.

    The 8-byte test passes on master too, because a build without ASan does not notice the one extra byte.

With a binary immbase, ds_print_data_type passed size * 8 bits to
r_str_bits with a 64 byte msg and an 8 byte copy of the item: an
8 byte item wrote one byte past msg, and a 31 byte .smi item wrote 249
bytes and read past buf (stack smashing detected). Size msg for 64 bits
and the NUL, and fall back to the hexdump for items over 8 bytes.

trufae commented Nov 3, 2026

Copy link
Copy Markdown
Collaborator

Good to merge. This fixes both the missing NUL byte and the out-of-bounds read for Cd 31. No new allocation or performance concern. CI's Linux test run has no unexpected failures.

Separate followups:

  • The same function already mishandles sizes 3 and 31. r_read_ble() only accepts 8/16/32/64 bits, so these return UT64_MAX. With wx 0102030405060708, Cd 3; ahi 3; pd 1 prints htons 65535, and Cd 31; ahi 31; pd 1 prints .smi 0x7fffffff, regardless of the bytes. What should these formats actually mean? Worth a small separate fix once that's clear.
  • When rebasing Fix #9756 - Show Cd data as data in pdj ##disasm #27320, keep both the 65-byte output buffer and the input-size guard in the shared formatter. Its current helper still has the old overflow.

@trufae
trufae merged commit 916cabe into radareorg:master Nov 3, 2026
50 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants