Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Conversation

@droe
Copy link
Contributor

@droe droe commented Dec 20, 2025

Addresses multiple issues in the arm context save/restore code:

  • When restoring from context, do not clobber pointers in CPUARMState with data from the context buffer. This causes use-after-free bugs usually manifesting as double-free crashes.
  • When saving to context, do not copy pointers from CPUARMState to the context buffer, to avoid leaking pointers to the context. Instead, zero the respective area of the context buffer, to ensure that reg_read and reg_write can access fields outside of the copied range. Specifically, env->uc needs to be NULL when accessed for a context.
  • When restoring to a CPU with a different nr than the source CPU, copy min(nr, ctx_nr) instead of nothing at all.
  • Add regression tests checking all CPU models for arm and arm64 for trivial double-free crashes.

Fixes #2195

Addresses multiple issues in the arm context save/restore code:
-   When restoring from context, do not clobber pointers in CPUARMState
    with data from the context buffer.  This causes use-after-free bugs
    usually manifesting as double-free crashes.
-   When saving to context, do not copy pointers from CPUARMState to the
    context buffer, to avoid leaking pointers to the context.  Instead,
    zero the respective area of the context buffer, to ensure that
    reg_read and reg_write can access fields outside of the copied
    range.  Specifically, env->uc needs to be NULL when accessed for a
    context.
-   When restoring to a CPU with a different nr than the source CPU,
    copy min(nr, ctx_nr) instead of nothing at all.
-   Add regression tests checking all CPU models for arm and arm64 for
    trivial double-free crashes.

Fixes unicorn-engine#2195
@droe droe force-pushed the droe/arm-context-fix branch from 3efb186 to 613df32 Compare December 20, 2025 23:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

Morty Proxy This is a proxified and sanitized view of the page, visit original site.