manticore
manticore copied to clipboard
Analysis fails with pure-symbolic mode
Summary of the problem
Analysis fails in pure-symbolic mode. The input program:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
int y = 3;
int main() {
read(0, &y, 1);
char a[10] = {0,};
if (y >= 0 && y < 10) {
if (a[y] == 77) {
printf("OK\n");
}
}
return 0;
}
Compile with:
gcc -static <src> -o <binariy>
Manticore version
0.3.4
Python version
3.6
OS / Environment
Ubuntu 16.04
Dependencies
...
Step to reproduce the behavior
manticore --pure-symbolic <binary>
Expected behavior
Successful analysis without exceptions.
Actual behavior
Exception (log attached).
Any relevant logs
2020-10-11 16:06:21,152: [15384] m.c.worker:ERROR: Exception in state 4: TypeError("'ArraySelect' object cannot be interpreted as an integer",)
Traceback (most recent call last):
File "/usr/local/lib/python3.6/dist-packages/manticore/core/worker.py", line 99, in run
current_state = m._get_state(wait=True)
File "/usr/local/lib/python3.6/dist-packages/manticore/core/manticore.py", line 637, in _get_state
return self._load(state_id)
File "/usr/local/lib/python3.6/dist-packages/manticore/utils/event.py", line 85, in newFunction
result = func(self, *args, **kw)
File "/usr/local/lib/python3.6/dist-packages/manticore/core/manticore.py", line 562, in _load
state = self._workspace.load_state(state_id, delete=False)
File "/usr/local/lib/python3.6/dist-packages/manticore/core/workspace.py", line 474, in load_state
return self._store.load_state(f"{self._prefix}{state_id:08x}{self._suffix}", delete=delete)
File "/usr/local/lib/python3.6/dist-packages/manticore/core/workspace.py", line 181, in load_state
state = self._serializer.deserialize(f)
File "/usr/local/lib/python3.6/dist-packages/manticore/utils/helpers.py", line 130, in deserialize
return pickle.load(GzipFile(fileobj=f, mode="rb") if consts.compress_states else f)
File "/usr/local/lib/python3.6/dist-packages/manticore/native/memory.py", line 298, in __init__
self._data[0 : len(data_init)] = data_init
TypeError: 'ArraySelect' object cannot be interpreted as an integer