-
Notifications
You must be signed in to change notification settings - Fork 87
Description
Describe the bug
When running the module identification plugin I am getting a SIGSEV error that crashes HAL.
To Reproduce
Something to do with module identification I do not have a sharable design that I know causes the issue.
Expected behavior
The calculations
Desktop (please complete the following information):
Ubuntu 24.04
Additional context
From module identification we call create_candidates for the functional candidates.
https://github.com/emsec/hal/blob/master/plugins/module_identification/src/api/module_identification.cpp#L169
auto new_candidates_res = FunctionalCandidate::create_candidates(sc, config.m_max_control_signals, sc->ctx, type, config.m_known_registers);
From there my specific type was constant_multiplication_offset (not sure if this is part of the problem).
Then we are calling create_input_extenson_variants. From there we are trying to perform apply_extension.
https://github.com/emsec/hal/blob/master/plugins/module_identification/src/processing/create_functional_candidates.cpp#L1775
new_candidate.m_operands.at(op_idx) = apply_extension(new_candidate.m_operands.at(op_idx), out_size, ex_s.at(op_idx), sign_net);
If the extension type is 2 "sign extended up until the second highest bit" and the size is 1, then the first extend will create an op vector of size 0 then the second will try to access index 0 and cause a crash.
case 2:
// sign extended up until the second highest bit
new_op = sign_extend_operand(new_op, size - 1, sign_net);
new_op = zero_extend_operand(new_op, size);
I am not sure why the size is 1, if that is the real problem and this is just a symptom.