Skip to content

Decompiler fails with "Recoverable Error: Unable to find unique hash for varnode" #9406

Description

@CUB3D

Describe the bug
When decompiling function test1 from this debug xml the decompiler fails in two different ways.

  1. When running the following commands in decomp_dbg, the decompiler crashes with a segfault:
restore ./path/to/asdf.xml
load function test1

This is the backtrace under gdb

Program received signal SIGSEGV, Segmentation fault.
0x0000555555999bd1 in ghidra::ParserContext::allocateOperand (this=0x555555cd1270, i=0, walker=...)
    at <snip>/ghidra_12.1.2_PUBLIC/Ghidra/Features/Decompiler/src/decompile/cpp/context.hh:197
197	 walker.point->resolve[i] = opstate;
(gdb) bt
#0  0x0000555555999bd1 in ghidra::ParserContext::allocateOperand (this=0x555555cd1270, i=0, walker=...)
    at <snip>/ghidra_12.1.2_PUBLIC/Ghidra/Features/Decompiler/src/decompile/cpp/context.hh:197
#1  0x00005555559f06e0 in ghidra::Sleigh::resolve (this=0x555555c9ff98, pos=...) at sleigh.cc:633
#2  0x00005555559f048b in ghidra::Sleigh::obtainContext (this=0x555555c9ff98, addr=..., state=2) at sleigh.cc:598
#3  0x00005555559f1010 in ghidra::Sleigh::oneInstruction (this=0x555555c9ff98, emit=..., baseaddr=...) at sleigh.cc:753
#4  0x0000555555790ee7 in ghidra::FlowInfo::processInstruction (this=0x7fffffffc8a0, curaddr=..., startbasic=@0x7fffffffc776: false) at flow.cc:421
#5  0x0000555555791def in ghidra::FlowInfo::fallthru (this=0x7fffffffc8a0) at flow.cc:559
#6  0x0000555555792e6b in ghidra::FlowInfo::generateOps (this=0x7fffffffc8a0) at flow.cc:778
#7  0x00005555557c583d in ghidra::Funcdata::followFlow (this=0x555555c4c980, baddr=..., eaddr=...) at funcdata_op.cc:771
#8  0x0000555555974829 in ghidra::IfaceDecompData::followFlow (this=0x555555c2f000, s=..., size=0) at ifacedecomp.cc:447
#9  0x0000555555974d06 in ghidra::IfcFuncload::execute (this=0x555555c3bf80, s=...) at ifacedecomp.cc:486
#10 0x000055555599ed53 in ghidra::IfaceStatus::runCommand (this=0x555555c2ee70) at interface.cc:375
#11 0x000055555598c88c in ghidra::execute (status=0x555555c2ee70, dcp=0x555555c2f000) at ifacedecomp.cc:3620
#12 0x000055555598ccba in ghidra::mainloop (status=0x555555c2ee70) at ifacedecomp.cc:3661
#13 0x0000555555a584b3 in main (argc=1, argv=0x7fffffffd108) at consolemain.cc:230

I believe this is the same issue as the first issue outlined in #9018, where a small fixed sized context buffer is written out of bounds.

Applying the same suggested fix of increasing the buffer size (to 128 items) and repeating produces this output:

[decomp]> restore /path/to/asdf.xml
/path/to/asdf.xml successfully loaded: Hexagon QDSP6 V81
[decomp]> load function test1
Function test1: 0xd043c390
[decomp]> decompile 
Decompiling test1
Function ERROR: Unable to find unique hash for varnode

In the actual Ghidra GUI only this second issue is observable

To Reproduce
Steps to reproduce the behavior:

  1. Install this plugin
  2. Restore this debug xml
  3. load function test1
  4. decompile
  5. Observe the error

Expected behavior
The function is decompiled without error

Screenshots
Image

Environment (please complete the following information):

  • OS: Linux
  • Java Version: OpenJDK 21.0.11
  • Ghidra Version: 12.1.2
  • Ghidra Origin: official GitHub distro

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions