You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When we restructure a CFG into an AST, we transform each condition into a symbol. Now, each node of a region gets its reaching condition assigned, thus a reaching condition can occur multiple times.
Consider the following example:
The putout is incorrect because the value of a changes and afterward, we have a check with the old value.
A binary where this problem also occurs is test_switch.ziptest18.
The C-code is:
inttest18()
{
intweek;
//Non sequential case constants/* Input week number from user */printf("Enter week number(1-7): ");
scanf("%d", &week);
switch(week)
{
case1:
printf("Monday");
week+=500 ;
case12:
printf("Tuesday");
break;
case500:
printf("Friday");
// break;default:
printf("Invalid input! Please enter week number between 1-7.");
}
printf("the number is %d", week);
return0;
}
and the output is:
inttest18() {
intvar_0;
int*var_1;
printf("Enter week number(1-7): ");
var_1=&var_0;
__isoc99_scanf(0x804c025, var_1);
switch(var_0) {
case1:
printf("Monday");
var_0+=0x1f4; // <-------- var_0 is changed here, but the old value should be used for the comparison in the if-statementbreak;
case0x1f4:
printf("Friday");
break;
}
if ((var_0!=1) && (var_0!=12)) { // <----------- If var_0 was 1 when reaching the switch, it is now != 1printf("Invalid input! Please enter week number between 1-7.");
}
else {
printf("Tuesday");
}
printf("the number is %d", var_0);
return0;
}
When entering the number 1, the function prints "Monday", "Tuesday", and "the number is 501".
But the decompiled function, with input 1 prints "Monday", "Invalid input! Please enter week number between 1-7.", and "the number is 501".
Affected Binary Ninja Version(s)
Version 2.4.2846
The text was updated successfully, but these errors were encountered:
What happened?
When we restructure a CFG into an AST, we transform each condition into a symbol. Now, each node of a region gets its reaching condition assigned, thus a reaching condition can occur multiple times.
Consider the following example:
The putout is incorrect because the value of
a
changes and afterward, we have a check with the old value.An correct output would, for example be:
How to reproduce?
A binary where this problem also occurs is test_switch.zip
test18
.The C-code is:
and the output is:
When entering the number 1, the function prints "Monday", "Tuesday", and "the number is 501".
But the decompiled function, with input 1 prints "Monday", "Invalid input! Please enter week number between 1-7.", and "the number is 501".
Affected Binary Ninja Version(s)
Version 2.4.2846
The text was updated successfully, but these errors were encountered: