diff options
| author | serpilliere <serpilliere@users.noreply.github.com> | 2018-02-15 23:07:49 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-02-15 23:07:49 +0100 |
| commit | 092d0bfaac18ffe683a8ef3a1dedc5dba80e7688 (patch) | |
| tree | f9bea52546592e40a390536e931e0f5c5375b233 | |
| parent | a861086781d551efb4aebccff95bd1539482849a (diff) | |
| parent | 2c62e418735010b8f816bc0d4d23973392ddceab (diff) | |
| download | focaccia-miasm-092d0bfaac18ffe683a8ef3a1dedc5dba80e7688.tar.gz focaccia-miasm-092d0bfaac18ffe683a8ef3a1dedc5dba80e7688.zip | |
Merge pull request #680 from commial/fix-simplifications
Fix a few simplifications
| -rw-r--r-- | miasm2/expression/simplifications_common.py | 21 | ||||
| -rw-r--r-- | test/expression/simplifications.py | 10 |
2 files changed, 27 insertions, 4 deletions
diff --git a/miasm2/expression/simplifications_common.py b/miasm2/expression/simplifications_common.py index ccb97cb3..a1301cba 100644 --- a/miasm2/expression/simplifications_common.py +++ b/miasm2/expression/simplifications_common.py @@ -40,13 +40,26 @@ def simp_cst_propagation(e_s, expr): elif op_name == '|': out = int1.arg | int2.arg elif op_name == '>>': - out = int1.arg >> int2.arg + if int(int2) > int1.size: + out = 0 + else: + out = int1.arg >> int2.arg elif op_name == '<<': - out = int1.arg << int2.arg + if int(int2) > int1.size: + out = 0 + else: + out = int1.arg << int2.arg elif op_name == 'a>>': tmp1 = mod_size2int[int1.arg.size](int1.arg) tmp2 = mod_size2uint[int2.arg.size](int2.arg) - out = mod_size2uint[int1.arg.size](tmp1 >> tmp2) + if tmp2 > int1.size: + is_signed = int(int1) & (1 << (int1.size - 1)) + if is_signed: + out = -1 + else: + out = 0 + else: + out = mod_size2uint[int1.arg.size](tmp1 >> tmp2) elif op_name == '>>>': shifter = int2.arg % int2.size out = (int1.arg >> shifter) | (int1.arg << (int2.size - shifter)) @@ -539,7 +552,7 @@ def simp_compose(e_s, expr): nxt = args[i + 1] if arg.is_mem() and nxt.is_mem(): gap = e_s(nxt.arg - arg.arg) - if gap.is_int() and int(gap) == arg.size / 8: + if gap.is_int() and arg.size % 8 == 0 and int(gap) == arg.size / 8: args = args[:i] + [ExprMem(arg.arg, arg.size + nxt.size)] + args[i + 2:] return ExprCompose(*args) diff --git a/test/expression/simplifications.py b/test/expression/simplifications.py index 0c516a8e..76deb565 100644 --- a/test/expression/simplifications.py +++ b/test/expression/simplifications.py @@ -411,6 +411,16 @@ to_test = [(ExprInt(1, 32) - ExprInt(1, 32), ExprInt(0, 32)), (a >> b >> c, a >> b >> c), # Left unmodified (a >> b_msb_null >> c_msb_null, a >> (b_msb_null + c_msb_null)), + + # Degenerated case from fuzzing, which had previously raised bugs + (ExprCompose(ExprInt(0x7, 3), ExprMem(ExprInt(0x39E21, 19), 1), ExprMem(ExprInt(0x39E21, 19), 1)), + ExprCompose(ExprInt(0x7, 3), ExprMem(ExprInt(0x39E21, 19), 1), ExprMem(ExprInt(0x39E21, 19), 1))), + (ExprOp('>>', ExprInt(0x5E580475, 92), ExprInt(0x7D800000000000000331720, 92)), + ExprInt(0x0, 92)), + (ExprOp('a>>', ExprInt(0x5E580475, 92), ExprInt(0x7D800000000000000331720, 92)), + ExprInt(0x0, 92)), + (ExprOp('a>>', ExprInt(-0x5E580475, 92), ExprInt(0x7D800000000000000331720, 92)), + ExprInt(-1, 92)), ] for e_input, e_check in to_test: |