AArch64: Fix diet-mode NULL deref in printMatrixTileVector (#3017)
Some checks failed
Python - Build and publish wheels with cibuildwheel / Building on ubuntu-latest - i686 - cp*-manylinux* (push) Failing after 2s
Python - Build and publish wheels with cibuildwheel / Building on ubuntu-latest - x86_64 - cp*-manylinux* (push) Failing after 2s
Python - Build and publish wheels with cibuildwheel / Building on ubuntu-latest - i686 - cp*-musllinux* (push) Failing after 2s
cstool / CAPSTONE_BPF_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_EVM_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_LOONGARCH_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_M680X_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_MIPS_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_MOS65XX_SUPPORT only (push) Failing after 3s
cstool / CAPSTONE_SH_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_SYSTEMZ_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_TRICORE_SUPPORT only (push) Failing after 2s
Python - Build and publish wheels with cibuildwheel / Building on ubuntu-latest - x86_64 - cp*-musllinux* (push) Failing after 2s
Python - Build and publish wheels with cibuildwheel / Make SDist (push) Failing after 2s
Packages Build / build_linux (push) Failing after 2s
cstool / CAPSTONE_AARCH64_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_ALPHA_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_ARC_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_ARM_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_HPPA_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_M68K_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_PPC_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_RISCV_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_SPARC_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_TMS320C64X_SUPPORT only (push) Failing after 3s
cstool / CAPSTONE_WASM_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_X86_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_XCORE_SUPPORT only (push) Failing after 2s
cstool / CAPSTONE_XTENSA_SUPPORT only (push) Failing after 2s
Run Test / ubuntu-22.04 x64 release - no assert warnings (push) Has been cancelled
Run Test / ubuntu-22.04 x64 debug - assert warn (push) Has been cancelled
Run Test / ubuntu-22.04 x64 release - assert warn (push) Has been cancelled
Run Test / ubuntu-22.04 x64 cmake (push) Has been cancelled
Run Test / ubuntu-24.04 x64 ASAN (push) Has been cancelled
Run Test / ubuntu-22.04 x64 make (push) Has been cancelled
Run Test / windows x64 MSVC 64bit (push) Has been cancelled
Run Test / windows x64 MSVC 64bit DIET (push) Has been cancelled
Cross Build Tests / [BUILD ONLY] Android 35 (arm64_v8a) NDK 29 (push) Has been cancelled
Cross Build Tests / QEMU Linux ARM (push) Has been cancelled
Cross Build Tests / QEMU Linux Mips64el (push) Has been cancelled
Cross Build Tests / QEMU Linux Mips 32 (push) Has been cancelled
Cross Build Tests / QEMU Linux PPC64 (push) Has been cancelled
Cross Build Tests / QEMU Linux s390x (push) Has been cancelled
Cross Build Tests / [BUILD ONLY] Windows i686 mingw (push) Has been cancelled
Python - Build and publish wheels with cibuildwheel / Building on windows-latest - AMD64 - cp* (push) Has been cancelled
Python - Build and publish wheels with cibuildwheel / Building on windows-11-arm - ARM64 - cp* (push) Has been cancelled
Python - Build and publish wheels with cibuildwheel / Building on ubuntu-24.04-arm - aarch64 - cp*-manylinux* (push) Has been cancelled
Python - Build and publish wheels with cibuildwheel / Building on ubuntu-24.04-arm - aarch64 - cp*-musllinux* (push) Has been cancelled
Python - Build and publish wheels with cibuildwheel / Building on macos-latest - arm64 - cp* (push) Has been cancelled
Python - Build and publish wheels with cibuildwheel / Building on windows-latest - x86 - cp* (push) Has been cancelled
Python - Build and publish wheels with cibuildwheel / Building on macos-15-intel - x86_64 - cp* (push) Has been cancelled
Packages Build / build_windows (push) Has been cancelled
Run clang-format-20 / clang-format-20 (push) Has been cancelled
Run clang-tidy / clang-tidy (push) Has been cancelled
Python - Build and publish wheels with cibuildwheel / publish (push) Has been cancelled

In CAPSTONE_DIET builds, getRegisterName() returns NULL because the
register-name string table is compiled out. Every other AArch64 printer
helper feeds that NULL into SStream_concat0(), which is a no-op on NULL
under CAPSTONE_DIET. printMatrixTileVector is the outlier: it calls
strlen(RegName) + 1 directly to size a scratch buffer, so a NULL
result causes SIGSEGV inside strlen().

Early-return after AArch64_add_cs_detail_1() when RegName is NULL, so
detail-mode users still get the operand recorded.

Repro on a diet aarch64 build:

    static const unsigned char code[] = { 0xc0, 0xc0, 0xc0, 0xc0 };
    cs_disasm(handle, code, sizeof(code), 0, 0, &insn);  /* SIGSEGV */

Fixes capstone-engine/capstone#3014

Co-authored-by: Amit Sides <amit-sides@users.noreply.github.com>
This commit is contained in:
Sides 2026-08-07 15:51:03 +03:00 committed by GitHub
parent 9933d7fd83
commit 1c1f6f4e9f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -964,6 +964,10 @@ DEFINE_printMatrix(0);
\
const char *RegName = getRegisterName(MCOperand_getReg(RegOp), \
AArch64_NoRegAltName); \
\
/* Diet builds have no register-name table; skip printing. */ \
if (!RegName) \
return; \
\
unsigned buf_len = strlen(RegName) + 1; \
char *Base = cs_mem_calloc(1, buf_len); \