Skip to content

Add three CFGFast crash fixtures found by a corpus audit - #213

Open
zardus wants to merge 3 commits into
masterfrom
audit/cfg-relocatable-gap-fixture
Open

Add three CFGFast crash fixtures found by a corpus audit#213
zardus wants to merge 3 commits into
masterfrom
audit/cfg-relocatable-gap-fixture

Conversation

@zardus

@zardus zardus commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Problem

An open angr pull request fixes a CFGFast abort that only reproduces on an i386 relocatable
whose code reads through %gs, and this repository has no such object. Scanning the 737 ELF files under
tests/ at the merge base 3bfd1de0 for an ELFCLASS32 EM_386 ET_REL object with a segment
override in an executable section:

ET_REL objects by machine: {'EM_386': 1, 'EM_AARCH64': 1, 'EM_ARM': 5, 'EM_AVR': 1,
                            'EM_MIPS': 1, 'EM_PPC': 1, 'EM_RISCV': 11, 'EM_X86_64': 62}
Shape A (EM_386 ET_REL with a segment-override instruction): 0 matches

So that regression had to assemble its caller in memory, which the test-input gate rejects. Two
further CFGFast crashes from the same corpus audit have no input here either.

Root cause

Header shape alone does not separate the other two objects from what is already here — 53 x86_64
relocatables already have an unmapped inter-section hole, and tests/armel/btrfs.ko is already an
ARM relocatable kernel module — so only the crash each one reproduces distinguishes it, and that
is what is measured below.

Fix

Three objects, read back from the committed bytes:

path size sha256 header
tests/i386/cfg_mapfail_static_member.o 14152 40666428fd5beec9267b3bef3e2ce368fdc782c7cf0c4bfff8f62192c86e3d65 ELFCLASS32 LSB SYSV, ET_REL, EM_386, 29 sections, 14 defined STT_FUNC, 45 undefined
tests/x86_64/relocatable_section_gap.o 12120 9169224dc719bfae42264b5ffed6c94f0837453175951b4262fa02a4f100dc03 ELFCLASS64 LSB SYSV, ET_REL, EM_X86_64, 14 sections, 5 defined STT_FUNC, 17 undefined
tests/armel/cfg_arm_elf_fast_resolve_put 99748 ac7420b96b6dbc22f5bebe863cde3f43f6bc385722f2a0660bd25af89ac85695 ELFCLASS32 LSB SYSV, ET_REL, EM_ARM, 35 sections, 35 defined STT_FUNC, 9 undefined

The i386 object is the libgomp member of a NetBSD static archive; the x86_64 object is a Lua
lundump.c object built by Ubuntu clang version 15.0.7; the ARM object is the unmodified
in-tree raid6_pq module of an ARMv7 Linux 6.6.141 build, license=GPL per its .modinfo, the
same situation as the btrfs.ko already here. None has a recorded build recipe, so none is
reproduced byte for byte from a command; each is a corpus object committed as found.

A fourth object on this branch, a 6502 Intel HEX image, was dropped: the tidy_data_references
crash it was collected for is already fixed, by angr #6811, whose regression uses the existing
tests/armel/lwip_tcpecho_bm.elf, so at master it reproduces nothing.

Testing

The same scan at the head reports 1 match for the i386 object. Loading each object with CFGFast
at angr 4ab97b7b raises, respectively, AngrExitError: Cannot execute following jumpkind Ijk_MapFail in pthread_create.static_exits, SimEngineError: No bytes in memory for block starting at 0x40158d in CFGFast._analyze_all_function_features, and IndexError: list index out of range in ArmElfFastResolver._resolve_put. Every same-shape object already in tests/
completes instead: all 53 x86_64 relocatables with an unmapped hole, including the 12 that also
end .text with a flush call, and all 5 ARM relocatables, btrfs.ko included even though it
reaches the same resolver.

Consumer: angr/angr#6809 loads the i386 object; the other two have none yet. Validation: #213 (comment)

session: sharpen

@zardus

zardus commented Aug 28, 2026

Copy link
Copy Markdown
Member Author

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Validation record for head e08757bf9e0c8a2b59cb2b7a6ad5aa8d844cf08b against baseline 3bfd1de09dd357deafbe29b4075aa55a9379ce50.

  • Readback: repro/fixture_facts.py — sha256, size and ELF header fields of all three objects, recorded in the description
  • Shape scan: repro/shape_scan.py over 1050 tracked files under tests/ at the baseline and 1053 at the head — shape A 0 -> 1, shape C 1 -> 2, shape B 53 -> 54
  • Build recipe: none recorded for any of the three; no tests_src/ entry, build.sh or Makefile in the tree names them, so none is reproduced byte for byte from a command
  • Consumer load, angr 4ab97b7b964ff2f251d00d547274cf167a9011bc: cfg_mapfail_static_member.o raises AngrExitError: Cannot execute following jumpkind Ijk_MapFail in pthread_create.static_exits; relocatable_section_gap.o raises SimEngineError: No bytes in memory for block starting at 0x40158d in CFGFast._analyze_all_function_features; cfg_arm_elf_fast_resolve_put raises IndexError: list index out of range in ArmElfFastResolver._resolve_put
  • Control, same invocation: 53 of 53 x86_64 relocatables that already have an unmapped inter-section hole complete, the 12 that also end .text with a flush call included; 5 of 5 ARM relocatables complete, tests/armel/btrfs.ko included even though it reaches _resolve_put once
  • Rebase: the branch was 18 commits behind origin/master and was rebased onto it; the three objects' blobs are byte-identical across the rebase (cc4f5d4e, 94e6ba28, a0ad6b70, 17f68d8e before, the same after), and two commit messages were reworded, one to name the real failing pass and one to record the ARM module's origin

Dropped from this branch: tests/6502/cfg_tidy_data_references.hex. Its CFGModel.tidy_data_references crash is fixed at master by angr #6811, whose regression uses the existing tests/armel/lwip_tcpecho_bm.elf, so the object reproduces nothing; and its bytes carry no identifying string, decoding as a 16 KB NES PRG-ROM bank with no stated origin or licence.

Caveats: the two relocatable_section_gap.o and cfg_arm_elf_fast_resolve_put objects have no consumer pull request yet. The 6502 measurement needed cle at c7e0d4db, because the workspace checkout cannot place a 16-bit image's extern object.

@zardus

zardus commented Aug 28, 2026

Copy link
Copy Markdown
Member Author

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Repository shape scan for the shapes these three objects supply, run over every tracked file under
tests/ at this pull request's merge base and again at its head. The scan is
repro/shape_scan.py, whose own docstring defines the shapes:

Scan an angr/binaries checkout for the four shapes this fixture set supplies.

Usage: shape_scan.py <checkout-root>

Shape A  i386 relocatable whose executable code reads through a segment
         override (%gs / %fs), which lifts to a guarded Ijk_MapFail exit.
Shape B  x86_64 relocatable whose CLE layout leaves an unmapped hole between
         two allocated sections.
Shape C  ARM relocatable Linux kernel module (a .gnu.linkonce.this_module
         section), the container the arm_elf_fast resolver mishandles.
Shape D  Intel HEX image (every record well formed and checksummed).

Both captures are the script's complete stdout. The workspace prefix of every absolute path has
been stripped, and the entering-the-dev-shell banner ahead of the first line is elided; the
loader's own warnings went to stderr and are not part of either capture.

Before — at the merge base 3bfd1de09dd357deafbe29b4075aa55a9379ce50, nothing in the
repository is an i386 relocatable that reads through a segment register, and the other two shapes
are already represented, which is why the crash controls in the description carry the argument
rather than the header shape:

angr/binaries master 
scan root: wt-bin-base
checkout head: 3bfd1de09dd357deafbe29b4075aa55a9379ce50
python: .venv/bin/python
capstone: .venv/lib/python3.12/site-packages/capstone/__init__.py
tracked files under tests/: 1050
ELF files under tests/: 737
files whose first byte is ':': 2
cle: repos/cle/cle/__init__.py
x86_64 relocatables to load with cle: 62

ET_REL objects by machine: {'EM_386': 1, 'EM_AARCH64': 1, 'EM_ARM': 5, 'EM_AVR': 1, 'EM_MIPS': 1, 'EM_PPC': 1, 'EM_RISCV': 11, 'EM_X86_64': 62}

Shape A (EM_386 ET_REL with a segment-override instruction): 0 matches
Shape B (EM_X86_64 ET_REL with an unmapped hole between allocated sections): 53 matches
   tests/x86_64/copy.o  .text ends 0x407cbf, next allocated section .data starts 0x407cc0
   tests/x86_64/csplit.o  .text ends 0x4031af, next allocated section .data starts 0x4031b0
   tests/x86_64/d_net.o  .text ends 0x401919, next allocated section .bss starts 0x401920
   tests/x86_64/decompiler/adds_then_call.o  .text ends 0x40004d, next allocated section .note.gnu.property starts 0x400050
   tests/x86_64/decompiler/b2sum-digest.o  .bss ends 0x401721, next allocated section .rodata.str1.8 starts 0x401728
   tests/x86_64/decompiler/b2sum-digest_shared_switch_nodes.o  .bss ends 0x401731, next allocated section .rodata.str1.8 starts 0x401738
   tests/x86_64/decompiler/base32-basenc.o  .text ends 0x400a11, next allocated section .rodata.str1.8 starts 0x400a18
   tests/x86_64/decompiler/cat.o  .text ends 0x400c82, next allocated section .data starts 0x400c90
   tests/x86_64/decompiler/certtool-common.o  .text ends 0x403ce4, next allocated section .bss starts 0x403d00
   tests/x86_64/decompiler/chcon.o  .text ends 0x400de2, next allocated section .bss starts 0x400df0
   tests/x86_64/decompiler/cksum-digest.o  .data ends 0x4018ec, next allocated section .bss starts 0x4018f0
   tests/x86_64/decompiler/clientloop.o  .text ends 0x406b72, next allocated section .data starts 0x406b74
   tests/x86_64/decompiler/coreutils_test.o  .rodata.str1.1 ends 0x401c3b, next allocated section .rodata starts 0x401c3c
   tests/x86_64/decompiler/dd.o  .text ends 0x4038da, next allocated section .data starts 0x4038e0
   tests/x86_64/decompiler/df.o  .text ends 0x40295a, next allocated section .data starts 0x40295c
   tests/x86_64/decompiler/du.o  .text ends 0x401069, next allocated section .data starts 0x401070
   tests/x86_64/decompiler/gzip.o  .text ends 0x4031db, next allocated section .data starts 0x4031dc
   tests/x86_64/decompiler/head.o  .bss ends 0x40196b, next allocated section .rodata.str1.8 starts 0x401970
   tests/x86_64/decompiler/iplink_bridge.o  .text ends 0x402065, next allocated section .bss starts 0x402068
   tests/x86_64/decompiler/iprule.o  .text ends 0x40289f, next allocated section .data starts 0x4028a0
   tests/x86_64/decompiler/ite.o  .text ends 0x40003b, next allocated section .note.gnu.property starts 0x400040
   tests/x86_64/decompiler/ls.o  .text ends 0x4077d7, next allocated section .data starts 0x4077d8
   tests/x86_64/decompiler/mkdir.o  .text ends 0x400653, next allocated section .rodata.str1.8 starts 0x400658
   tests/x86_64/decompiler/numfmt.o  .text ends 0x40271c, next allocated section .data starts 0x402720
   tests/x86_64/decompiler/od.o  .data ends 0x402988, next allocated section .bss starts 0x4029a0
   tests/x86_64/decompiler/od_gccO2.o  .data ends 0x40269d, next allocated section .bss starts 0x4026a0
   tests/x86_64/decompiler/printenv.o  .rodata.str1.1 ends 0x4004b6, next allocated section .rodata.str1.8 starts 0x4004b8
   tests/x86_64/decompiler/ptx.o  .text ends 0x402d9a, next allocated section .data starts 0x402da0
   tests/x86_64/decompiler/remove.o  .rodata.str1.1 ends 0x4010aa, next allocated section .rodata.str1.8 starts 0x4010b0
   tests/x86_64/decompiler/sha384sum-digest.o  .text ends 0x4014ce, next allocated section .data starts 0x4014d0
   tests/x86_64/decompiler/sort.o  .text ends 0x406a5a, next allocated section .data starts 0x406a60
   tests/x86_64/decompiler/split.o  .text ends 0x4026fb, next allocated section .data starts 0x4026fc
   tests/x86_64/decompiler/stat.o  .text ends 0x402d96, next allocated section .bss starts 0x402da0
   tests/x86_64/decompiler/stty.o  .text ends 0x4029c7, next allocated section .data starts 0x4029c8
   tests/x86_64/decompiler/tail.o  .text ends 0x40457a, next allocated section .data starts 0x404580
   tests/x86_64/decompiler/test.o  .rodata.str1.1 ends 0x401c3b, next allocated section .rodata starts 0x401c3c
   tests/x86_64/decompiler/touch_touch_no_switch.o  .text ends 0x40078d, next allocated section .bss starts 0x4007a0
   tests/x86_64/decompiler/tr.o  .text ends 0x402148, next allocated section .bss starts 0x402160
   tests/x86_64/decompiler/tr_O2.o  .text ends 0x401821, next allocated section .bss starts 0x401840
   tests/x86_64/decompiler/tsort.o  .text ends 0x400c2d, next allocated section .bss starts 0x400c30
   tests/x86_64/decompiler/uname.o  .rodata.str1.8 ends 0x400b31, next allocated section .rodata starts 0x400b38
   tests/x86_64/decompiler/who.o  .text ends 0x4016ad, next allocated section .data starts 0x4016b0
   tests/x86_64/decompiler/whoami.o  .rodata.str1.8 ends 0x4005d9, next allocated section .text.startup starts 0x4005e0
   tests/x86_64/df.o  .data ends 0x404294, next allocated section .bss starts 0x4042a0
   tests/x86_64/divisions_gcc_O1.o  .text ends 0x400173, next allocated section .note.gnu.property starts 0x400178
   tests/x86_64/f_finale.o  .text ends 0x40144d, next allocated section .bss starts 0x401450
   tests/x86_64/g_game.o  .text ends 0x4035c9, next allocated section .data starts 0x4035e0
   tests/x86_64/multiarch_main_main.o  .text ends 0x4042f1, next allocated section .bss starts 0x404300
   tests/x86_64/mv.o  .text ends 0x4013a9, next allocated section .bss starts 0x4013b0
   tests/x86_64/p_plats.o  .text ends 0x40095b, next allocated section .bss starts 0x400960
   tests/x86_64/test.o  .rodata.str1.1 ends 0x401c2b, next allocated section .rodata starts 0x401c2c
   tests/x86_64/test_cmovneq  .text ends 0x400015, next allocated section .note.gnu.property starts 0x400018
   tests/x86_64/test_structs.o  .text ends 0x400598, next allocated section .rodata starts 0x4005a0
Shape C (EM_ARM ET_REL Linux kernel module): 1 matches
    tests/armel/btrfs.ko
Shape D (well-formed Intel HEX image): 2 matches
    tests/armel/i2c_master_read-arduino_mzero.hex
    tests/armhf/decompiler/06aa650f61d71744c6709c7c092d9169.hex

After — at head e08757bf9e0c8a2b59cb2b7a6ad5aa8d844cf08b, shape A has its first match and
shape C gains one. Shape D is unchanged at 2, because the 6502 Intel HEX image that was on this
branch has been dropped:

with this branch 
scan root: wt-bin
checkout head: e08757bf9e0c8a2b59cb2b7a6ad5aa8d844cf08b
python: .venv/bin/python
capstone: .venv/lib/python3.12/site-packages/capstone/__init__.py
tracked files under tests/: 1053
ELF files under tests/: 740
files whose first byte is ':': 2
cle: repos/cle/cle/__init__.py
x86_64 relocatables to load with cle: 63

ET_REL objects by machine: {'EM_386': 2, 'EM_AARCH64': 1, 'EM_ARM': 6, 'EM_AVR': 1, 'EM_MIPS': 1, 'EM_PPC': 1, 'EM_RISCV': 11, 'EM_X86_64': 63}

Shape A (EM_386 ET_REL with a segment-override instruction): 1 matches
    tests/i386/cfg_mapfail_static_member.o
Shape B (EM_X86_64 ET_REL with an unmapped hole between allocated sections): 54 matches
   tests/x86_64/copy.o  .text ends 0x407cbf, next allocated section .data starts 0x407cc0
   tests/x86_64/csplit.o  .text ends 0x4031af, next allocated section .data starts 0x4031b0
   tests/x86_64/d_net.o  .text ends 0x401919, next allocated section .bss starts 0x401920
   tests/x86_64/decompiler/adds_then_call.o  .text ends 0x40004d, next allocated section .note.gnu.property starts 0x400050
   tests/x86_64/decompiler/b2sum-digest.o  .bss ends 0x401721, next allocated section .rodata.str1.8 starts 0x401728
   tests/x86_64/decompiler/b2sum-digest_shared_switch_nodes.o  .bss ends 0x401731, next allocated section .rodata.str1.8 starts 0x401738
   tests/x86_64/decompiler/base32-basenc.o  .text ends 0x400a11, next allocated section .rodata.str1.8 starts 0x400a18
   tests/x86_64/decompiler/cat.o  .text ends 0x400c82, next allocated section .data starts 0x400c90
   tests/x86_64/decompiler/certtool-common.o  .text ends 0x403ce4, next allocated section .bss starts 0x403d00
   tests/x86_64/decompiler/chcon.o  .text ends 0x400de2, next allocated section .bss starts 0x400df0
   tests/x86_64/decompiler/cksum-digest.o  .data ends 0x4018ec, next allocated section .bss starts 0x4018f0
   tests/x86_64/decompiler/clientloop.o  .text ends 0x406b72, next allocated section .data starts 0x406b74
   tests/x86_64/decompiler/coreutils_test.o  .rodata.str1.1 ends 0x401c3b, next allocated section .rodata starts 0x401c3c
   tests/x86_64/decompiler/dd.o  .text ends 0x4038da, next allocated section .data starts 0x4038e0
   tests/x86_64/decompiler/df.o  .text ends 0x40295a, next allocated section .data starts 0x40295c
   tests/x86_64/decompiler/du.o  .text ends 0x401069, next allocated section .data starts 0x401070
   tests/x86_64/decompiler/gzip.o  .text ends 0x4031db, next allocated section .data starts 0x4031dc
   tests/x86_64/decompiler/head.o  .bss ends 0x40196b, next allocated section .rodata.str1.8 starts 0x401970
   tests/x86_64/decompiler/iplink_bridge.o  .text ends 0x402065, next allocated section .bss starts 0x402068
   tests/x86_64/decompiler/iprule.o  .text ends 0x40289f, next allocated section .data starts 0x4028a0
   tests/x86_64/decompiler/ite.o  .text ends 0x40003b, next allocated section .note.gnu.property starts 0x400040
   tests/x86_64/decompiler/ls.o  .text ends 0x4077d7, next allocated section .data starts 0x4077d8
   tests/x86_64/decompiler/mkdir.o  .text ends 0x400653, next allocated section .rodata.str1.8 starts 0x400658
   tests/x86_64/decompiler/numfmt.o  .text ends 0x40271c, next allocated section .data starts 0x402720
   tests/x86_64/decompiler/od.o  .data ends 0x402988, next allocated section .bss starts 0x4029a0
   tests/x86_64/decompiler/od_gccO2.o  .data ends 0x40269d, next allocated section .bss starts 0x4026a0
   tests/x86_64/decompiler/printenv.o  .rodata.str1.1 ends 0x4004b6, next allocated section .rodata.str1.8 starts 0x4004b8
   tests/x86_64/decompiler/ptx.o  .text ends 0x402d9a, next allocated section .data starts 0x402da0
   tests/x86_64/decompiler/remove.o  .rodata.str1.1 ends 0x4010aa, next allocated section .rodata.str1.8 starts 0x4010b0
   tests/x86_64/decompiler/sha384sum-digest.o  .text ends 0x4014ce, next allocated section .data starts 0x4014d0
   tests/x86_64/decompiler/sort.o  .text ends 0x406a5a, next allocated section .data starts 0x406a60
   tests/x86_64/decompiler/split.o  .text ends 0x4026fb, next allocated section .data starts 0x4026fc
   tests/x86_64/decompiler/stat.o  .text ends 0x402d96, next allocated section .bss starts 0x402da0
   tests/x86_64/decompiler/stty.o  .text ends 0x4029c7, next allocated section .data starts 0x4029c8
   tests/x86_64/decompiler/tail.o  .text ends 0x40457a, next allocated section .data starts 0x404580
   tests/x86_64/decompiler/test.o  .rodata.str1.1 ends 0x401c3b, next allocated section .rodata starts 0x401c3c
   tests/x86_64/decompiler/touch_touch_no_switch.o  .text ends 0x40078d, next allocated section .bss starts 0x4007a0
   tests/x86_64/decompiler/tr.o  .text ends 0x402148, next allocated section .bss starts 0x402160
   tests/x86_64/decompiler/tr_O2.o  .text ends 0x401821, next allocated section .bss starts 0x401840
   tests/x86_64/decompiler/tsort.o  .text ends 0x400c2d, next allocated section .bss starts 0x400c30
   tests/x86_64/decompiler/uname.o  .rodata.str1.8 ends 0x400b31, next allocated section .rodata starts 0x400b38
   tests/x86_64/decompiler/who.o  .text ends 0x4016ad, next allocated section .data starts 0x4016b0
   tests/x86_64/decompiler/whoami.o  .rodata.str1.8 ends 0x4005d9, next allocated section .text.startup starts 0x4005e0
   tests/x86_64/df.o  .data ends 0x404294, next allocated section .bss starts 0x4042a0
   tests/x86_64/divisions_gcc_O1.o  .text ends 0x400173, next allocated section .note.gnu.property starts 0x400178
   tests/x86_64/f_finale.o  .text ends 0x40144d, next allocated section .bss starts 0x401450
   tests/x86_64/g_game.o  .text ends 0x4035c9, next allocated section .data starts 0x4035e0
   tests/x86_64/multiarch_main_main.o  .text ends 0x4042f1, next allocated section .bss starts 0x404300
   tests/x86_64/mv.o  .text ends 0x4013a9, next allocated section .bss starts 0x4013b0
   tests/x86_64/p_plats.o  .text ends 0x40095b, next allocated section .bss starts 0x400960
   tests/x86_64/relocatable_section_gap.o  .text ends 0x40158d, next allocated section .rodata.cst8 starts 0x401590
   tests/x86_64/test.o  .rodata.str1.1 ends 0x401c2b, next allocated section .rodata starts 0x401c2c
   tests/x86_64/test_cmovneq  .text ends 0x400015, next allocated section .note.gnu.property starts 0x400018
   tests/x86_64/test_structs.o  .text ends 0x400598, next allocated section .rodata starts 0x4005a0
Shape C (EM_ARM ET_REL Linux kernel module): 2 matches
    tests/armel/btrfs.ko
    tests/armel/cfg_arm_elf_fast_resolve_put
Shape D (well-formed Intel HEX image): 2 matches
    tests/armel/i2c_master_read-arduino_mzero.hex
    tests/armhf/decompiler/06aa650f61d71744c6709c7c092d9169.hex

@zardus zardus mentioned this pull request Aug 28, 2026
Open
zardus added 2 commits August 29, 2026 06:04
@zardus
Add an x86_64 relocatable whose last call returns into an unmapped hole
3c2eb4a 
A 12 KB ET_REL Lua object, built by clang 15.0.7 from lundump.c. Under
CLE at base 0x400000 its .text spans [0x400000, 0x40158d) and the next
allocated section, .rodata.cst8, starts at 0x401590, so three bytes are
mapped by no section and no segment. The last instruction of .text is a
call to error, which angr concludes returns, so the return site is the
first unmapped byte and CFGFast._analyze_all_function_features lifts it,
raising SimEngineError out of the whole analysis.

Fifty-three other x86_64 relocatables under tests/ have the same hole and
all complete; twelve of those also end .text with a flush call, and in
every one the callee does not return.
@zardus
Add two CFGFast crash fixtures found by corpus audit
f526aa5 
cfg_mapfail_static_member.o: a 14 KB i386 relocatable, the libgomp member
of a NetBSD static archive. gomp_team_start reads through %gs at 0x400815,
so the blocks CFGFast pre-executes ahead of its call sites end in a guarded
Ijk_MapFail exit and the analysis aborts with AngrExitError. It is the only
EM_386 relocatable under tests/ that carries a segment override.

cfg_arm_elf_fast_resolve_put: the unmodified in-tree raid6_pq module from
an ARMv7 Linux 6.6.141 build, GPL-2 per its .modinfo. Its first block
contains register-to-register Add32 operations, so ArmElfFastResolver.
_resolve_put finds no constant to index and raises IndexError. The five
other ARM relocatables under tests/ all complete, btrfs.ko included even
though it reaches the same resolver.
@zardus
zardus force-pushed the audit/cfg-relocatable-gap-fixture branch from e08757b to f526aa5 Compare August 29, 2026 06:04
@zardus

zardus commented Aug 29, 2026

Copy link
Copy Markdown
Member Author

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Rebased onto binaries master: e08757bf9e0c8a2b59cb2b7a6ad5aa8d844cf08b -> f526aa5c0ad73f8d7acbadfba01418a43448ea06, both commits replayed with byte-identical patches (compared with context discarded).

This was not cosmetic. The branch sat one commit behind master, and that commit — a87538b, "Add Windows ARM64 and ARMNT fastfail fixtures" — adds tests/aarch64/windows/fastfail_arm64.exe and tests/armel/windows/fastfail_armnt.exe. Consumers pin a referenced sibling at its branch tip rather than at its merge with master, so every pull request naming this one was being tested against a fixture set missing those two files. angr/angr#6809's Test Results was red for exactly that reason, on two tests its own diff does not touch.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@zardus