Project: unicorn (unicorn-engine/unicorn), language: c++
Vulnerability instance: unicorn.cve-2022-29694
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/unicorn-engine/unicorn/issues/1588
## Description:
Issue: unicorn-engine/unicorn#1588
Title: Null pointer dereference in `qemu_ram_free` when HVA malloc fails
State: closed
Created by: liyansong2018
Created at: 2022-04-12 12:06:38+00:00

Issue Body:
When we try to use `uc_mem_map` to apply for super large memory, memory allocation in HAV fails, but succeeds  in GVA. This inconsistency leads to null pointer dereference in `us_ close` release about the ram block requested by `uc_mem_map`.

PoC
```c
int main(int argc, char **argv) {
    uc_engine *uc;
    uc_err err;
    err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc);
    if (err != UC_ERR_OK) {
        printf("Failed on uc_open() with error returned: %u %s\n", err, uc_strerror(err));
        return -1;
    }

    err = uc_mem_map(uc, 0x0, 0xfffffffff000, UC_PROT_ALL);
    if (err != UC_ERR_OK) {
        printf("Failed on uc_open() with error returned: %u %s\n", err, uc_strerror(err));
        //return -1;
    }
    uc_close(uc);
    return 0;
}
```

output
```shell
$ ./poc_test
AddressSanitizer:DEADLYSIGNAL
=================================================================
==36945==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f6f0c61dc5f bp 0x7ffd6adc9320 sp 0x7ffd6adc9310 T0)                                                                                                                   
==36945==The signal is caused by a WRITE memory access.                                                                    
==36945==Hint: address points to the zero page.
    #0 0x7f6f0c61dc5f in qemu_ram_free_x86_64 /home/lys/Documents/my/unicorn/qemu/exec.c:1133
    #1 0x7f6f0c624483 in memory_region_destructor_ram /home/lys/Documents/my/unicorn/qemu/softmmu/memory.c:882
    #2 0x7f6f0c62269f in memory_free_x86_64 /home/lys/Documents/my/unicorn/qemu/softmmu/memory.c:182
    #3 0x7f6f0c6169da in release_common /home/lys/Documents/my/unicorn/qemu/unicorn_common.h:62
    #4 0x7f6f0c616cd3 in x86_release /home/lys/Documents/my/unicorn/qemu/target/i386/unicorn.c:47
    #5 0x7f6f0c60e4c5 in uc_close /home/lys/Documents/my/unicorn/uc.c:419
    #6 0x55955d1423e1 in main /home/lys/Documents/unitest/poc_test.c:60
    #7 0x7f6f0c0d47ec in __libc_start_main ../csu/libc-start.c:332
    #8 0x55955d142129 in _start (/home/lys/Documents/unitest/poc_test+0x1129)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/lys/Documents/my/unicorn/qemu/exec.c:1133 in qemu_ram_free_x86_64
==36945==ABORTING
```


Comments:
Comment by liyansong2018 on 2022-04-12 12:15:16+00:00:
There are many ways to fix this bug. I will pull request with a simple patch later.

---

Comment by wtdcode on 2022-04-16 17:18:22+00:00:
Fixed in 3d3deac5e6d38602b689c4fef5dac004f07a2e63

Commit References:
3d3deac5e6d38602b689c4fef5dac004f07a2e63

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake .. -DCMAKE_BUILD_TYPE=Debug -DBUILD_SHARED_LIBS=off -DUNICORN_FUZZ=1
make -j4

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y cmake pkg-config make python3
RUN git clone https://github.com/unicorn-engine/unicorn unicorn
RUN git -C unicorn checkout cf18982e1c29d354805863a8e017cddd974e3114
WORKDIR $SRC/unicorn
COPY build.sh $SRC/

Additional files: