Project: unicorn (unicorn-engine/unicorn), language: c++
Vulnerability instance: unicorn.cve-2022-29693
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/unicorn-engine/unicorn/issues/1586
## Description:
Issue: unicorn-engine/unicorn#1586
Title: Memory leaks caused by unexpected architecture in unicorn dev branch
State: closed
Created by: liyansong2018
Created at: 2022-04-11 07:30:52+00:00

Issue Body:
Hi :)

When we used unexpected architecture such as `0`, there was a memory leak in unicorn2.

PoC
```c
int main(int argc, char **argv) {
    uc_engine *uc;
    uc_err err;

    /* Initialize emulator in X86-64bit mode */
    err = uc_open(0, UC_MODE_64, &uc);
    
    if (err == UC_ERR_OK) {
        printf("Failed on uc_open() with error returned: %u\n", err);
        printf("%s\n", uc_strerror(err));
        return -1;
    }

    if (err == UC_ERR_ARCH) {
        printf("Failed on uc_open() with error returned: %u\n", err);
        printf("%s\n", uc_strerror(err));
    } 

    uc_close(uc);
    return 0;
}

```

If we don't use `uc_close(uc)`, there will be a memory leak.
```shell
$ ./poc_test
Failed on uc_open() with error returned: 2
Invalid/unsupported architecture (UC_ERR_ARCH)

=================================================================
==22499==ERROR: LeakSanitizer: detected memory leaks
                                                                                                                           
Direct leak of 14720 byte(s) in 1 object(s) allocated from:
    #0 0x7f2082fde037 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154                  
    #1 0x7f2081bddfce in uc_open /home/lys/Documents/my/unicorn/uc.c:236
    #2 0x563051f0b278 in main /home/lys/Documents/unitest/poc_test.c:17
    #3 0x7f20816a47ec in __libc_start_main ../csu/libc-start.c:332

SUMMARY: AddressSanitizer: 14720 byte(s) leaked in 1 allocation(s).

```

If we use `uc_close(uc)`, there will be a segmentation fault!
```shell
$ ./poc_test
Failed on uc_open() with error returned: 2
Invalid/unsupported architecture (UC_ERR_ARCH)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==22535==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000075d (pc 0x7f5eb03ee46b bp 0x7ffe556843e0 sp 0x7ffe556843c0 T0)                                                                                                                   
==22535==The signal is caused by a READ memory access.                                                                     
==22535==Hint: address points to the zero page.
    #0 0x7f5eb03ee46b in uc_close /home/lys/Documents/my/unicorn/uc.c:412
    #1 0x5573d73fb32d in main /home/lys/Documents/unitest/poc_test.c:30
    #2 0x7f5eafeb47ec in __libc_start_main ../csu/libc-start.c:332
    #3 0x5573d73fb119 in _start (/home/lys/Documents/unitest/poc_test+0x1119)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/lys/Documents/my/unicorn/uc.c:412 in uc_close
==22535==ABORTING

```




Comments:
Comment by wtdcode on 2022-04-11 08:47:45+00:00:
Closed due to PR merged.

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake .. -DCMAKE_BUILD_TYPE=Debug -DBUILD_SHARED_LIBS=off -DUNICORN_FUZZ=1
make -j4

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y cmake pkg-config make python3
RUN git clone https://github.com/unicorn-engine/unicorn unicorn
RUN git -C unicorn checkout e3d0a33ab83c9dd65134da0c0a10a6a91173a08c
WORKDIR $SRC/unicorn
COPY build.sh $SRC/

Additional files: