OverflowError: cannot fit 'int' into an index-sized integer while using CFGEmulated with keep_state=True

I’m trying to create a CFG on the babyheap binary located here. When I have keep_state=True, I get the following stacktrace:

Traceback (most recent call last):
  File "babyheap_analysis.py", line 11, in <module>
    main()
  File "babyheap_analysis.py", line 6, in main
    cfg = babyheap.analyses.CFGEmulated(keep_state=True)
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/analyses/analysis.py", line 109, in __call__
    oself.__init__(*args, **kwargs)
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/analyses/cfg/cfg_emulated.py", line 301, in __init__
    self._analyze()
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/analyses/forward_analysis.py", line 583, in _analyze
    self._analysis_core_baremetal()
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/analyses/forward_analysis.py", line 693, in _analysis_core_baremetal
    self._pre_job_handling(job_info.job)
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/analyses/cfg/cfg_emulated.py", line 1122, in _pre_job_handling
    sim_successors, exception_info, _ = self._get_simsuccessors(addr, job, current_function_addr=job.func_addr)
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/analyses/cfg/cfg_emulated.py", line 2834, in _get_simsuccessors
    opt_level=self._iropt_level)
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/factory.py", line 54, in successors
    return self.project.engines.successors(*args, **kwargs)
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/engines/hub.py", line 128, in successors
    r = engine.process(state, **kwargs)
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/engines/hook.py", line 55, in process
    return self.project.factory.procedure_engine.process(state, procedure, force_addr=force_addr, **kwargs)
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/engines/procedure.py", line 31, in process
    force_addr=force_addr)
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/engines/engine.py", line 60, in process
    self._process(new_state, successors, *args, **kwargs)
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/engines/procedure.py", line 65, in _process
    inst = procedure.execute(state, successors, ret_to=ret_to)
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/sim_procedure.py", line 182, in execute
    r = getattr(inst, inst.run_func)(*sim_args, **inst.kwargs)
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/procedures/posix/read.py", line 15, in run
    return simfd.read(dst, length)
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/storage/file.py", line 611, in read
    self.state.memory.store(pos, data, size=realsize)
  File "/home/vivin/Projects/cmt/venv/lib/python3.6/site-packages/angr/storage/memory.py", line 517, in store
    if len(data_e) % self.state.arch.byte_width != 0:
OverflowError: cannot fit 'int' into an index-sized integer

When keep_state is False, this error is not present. Is there something I’m doing wrong, or could this be a bug?

My code is as follows:

import angr


def main():
    babyheap = angr.Project("0ctfbabyheap")
    cfg = babyheap.analyses.CFGEmulated(keep_state=True)


if __name__ == "__main__":
    main()

[ltfish]

@vivin This problem will not be addressed in the next release of angr… I’ll wait until I have an elegant solution for it.

The workaround is to manually add a check in the read SimProcedure before the size is determined and cap it to a reasonable limit (say, 0x1000). It is dirty, I know…

[ltfish]

My plan to address this issue is to add checks at SimProcedures to make sure we don’t perform insane memory accesses like this one. I did not find a clean way to do so though.