Repository: angr/angr

Issue:
Bug about arm instruction VCVT. IndexError: tuple index out of range
<!--
*Disclaimer:
The angr suite is maintained by a small team of volunteers.
While we cannot guarantee any timeliness for fixes and enhancements, we will do our best.
For more real-time help with angr, from us and the community, join our [Slack.](http://angr.io/invite/)*
-->
---

**Describe the bug.**
The execution of VCVT instruction will throw a IndexError: tuple index out of range.

```
Traceback (most recent call last):
  File "../examiner/samples/angr_test_inst.py", line 40, in <module>
    succ = state.step(num_inst=1)
  File "/home/xtyi/opensource/angr-dev/angr/angr/sim_state.py", line 587, in step
    return self.project.factory.successors(self, **kwargs)
  File "/home/xtyi/opensource/angr-dev/angr/angr/factory.py", line 60, in successors
    return self.default_engine.process(*args, **kwargs)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/light/slicing.py", line 19, in process
    return super().process(*args, **kwargs)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/engine.py", line 149, in process
    self.process_successors(self.successors, **kwargs)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/failure.py", line 21, in process_successors
    return super().process_successors(successors, **kwargs)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/syscall.py", line 18, in process_successors
    return super().process_successors(successors, **kwargs)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/hook.py", line 54, in process_successors
    return super().process_successors(successors, procedure=procedure, **kwargs)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/unicorn.py", line 169, in process_successors
    return super().process_successors(successors, **kwargs)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/soot/engine.py", line 64, in process_successors
    return super().process_successors(successors, **kwargs)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/heavy/heavy.py", line 138, in process_successors
    self.handle_vex_block(irsb)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/heavy/super_fastpath.py", line 19, in handle_vex_block
    super().handle_vex_block(irsb)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/light/slicing.py", line 26, in handle_vex_block
    super().handle_vex_block(irsb)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/heavy/actions.py", line 30, in handle_vex_block
    super().handle_vex_block(irsb)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/heavy/inspect.py", line 45, in handle_vex_block
    super().handle_vex_block(irsb)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/light/light.py", line 446, in handle_vex_block
    self._handle_vex_stmt(stmt)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/light/slicing.py", line 30, in _handle_vex_stmt
    super()._handle_vex_stmt(stmt)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/heavy/inspect.py", line 40, in _handle_vex_stmt
    super()._handle_vex_stmt(stmt)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/light/resilience.py", line 36, in inner
    return getattr(super(VEXResilienceMixin, self), func)(*iargs, **ikwargs)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/heavy/heavy.py", line 204, in _handle_vex_stmt
    super()._handle_vex_stmt(stmt)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/light/light.py", line 51, in _handle_vex_stmt
    handler(stmt)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/light/light.py", line 188, in _handle_vex_stmt_WrTmp
    self._analyze_vex_stmt_WrTmp_data(stmt.data)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/light/light.py", line 184, in _analyze_vex_stmt_WrTmp_data
    def _analyze_vex_stmt_WrTmp_data(self, *a, **kw): return self. _handle_vex_expr(*a, **kw)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/heavy/inspect.py", line 31, in _handle_vex_expr
    return super()._handle_vex_expr(expr)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/light/light.py", line 55, in _handle_vex_expr
    result = handler(expr)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/light/light.py", line 112, in _handle_vex_expr_Unop
    return self._handle_vex_expr_Op(expr)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/light/light.py", line 120, in _handle_vex_expr_Op
    return self._perform_vex_expr_Op(expr.op, [self._handle_vex_expr(arg) for arg in expr.args])
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/heavy/actions.py", line 49, in _perform_vex_expr_Op
    result = super()._perform_vex_expr_Op(op, exprs)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/light/resilience.py", line 36, in inner
    return getattr(super(VEXResilienceMixin, self), func)(*iargs, **ikwargs)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/claripy/datalayer.py", line 104, in _perform_vex_expr_Op
    return simop.calculate(*args)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/claripy/irop.py", line 377, in calculate
    return self._calculate(args)
  File "/home/xtyi/opensource/angr-dev/angr/angr/engines/vex/claripy/irop.py", line 870, in _op_fp_to_int
    arg = args[1].raw_to_fp()
IndexError: tuple index out of range
```

**Environment Information.**
<!--
Many common issues are caused by problems with the local Python environment.
Before submitting, double-check that your versions of all modules in the angr suite (angr, cle, pyvex, ...) are up to date.
Please include the output of `python -m angr.misc.bug_report` here.
-->

```
/home/xtyi/opensource/angr-dev/angr/angr/misc/bug_report.py:1: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses
  import imp
angr environment report
=============================
Date: 2021-07-18 11:06:25.337392
Running in virtual environment at /home/xtyi/workspace/examiner/.venv
Platform: linux-x86_64
Python version: 3.8.10 (default, Jun  2 2021, 10:49:15)
[GCC 9.4.0]
######## angr #########
Python found it in /home/xtyi/opensource/angr-dev/angr/angr
Pip version angr 9.0.gitrolling
Git info:
	Current commit 7967cb4d7c6728411b59aeec7fa6a6554e2636f5 from branch master
	Checked out from remote origin: https://github.com/angr/angr
######## ailment #########
Python found it in /home/xtyi/opensource/angr-dev/ailment/ailment
Pip version ailment 9.0.gitrolling
Git info:
	Current commit 633844e40c09f18aa936d612139d9f846f2a409b from branch master
	Checked out from remote origin: https://github.com/angr/ailment
######## cle #########
Python found it in /home/xtyi/opensource/angr-dev/cle/cle
Pip version cle 9.0.gitrolling
Git info:
	Current commit d45d4b95d1c607d00d27b4896e6a1813ee3d34fb from branch master
	Checked out from remote origin: https://github.com/angr/cle
######## pyvex #########
Python found it in /home/xtyi/opensource/angr-dev/pyvex/pyvex
Pip version pyvex 9.0.gitrolling
Git info:
	Current commit b7006517fcb9fcd713b070315b7c18277c942113 from branch master
	Checked out from remote origin: https://github.com/angr/pyvex
######## claripy #########
Python found it in /home/xtyi/opensource/angr-dev/claripy/claripy
Pip version claripy 9.0.gitrolling
Git info:
	Current commit d372dd28bede388d44c018b06168239ca335329a from branch master
	Checked out from remote origin: https://github.com/angr/claripy
######## archinfo #########
Python found it in /home/xtyi/opensource/angr-dev/archinfo/archinfo
Pip version archinfo 9.0.gitrolling
Git info:
	Current commit b150db4c0a939140966df8b0056b6deb5b07efbf from branch master
	Checked out from remote origin: https://github.com/angr/archinfo
######## z3 #########
Python found it in /home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/z3
Pip version z3-solver 4.8.12.0
Git info:
	Current commit 496667ee2ec614c60d28000ba88f77a8303daeee from branch master
	Checked out from remote origin: ssh://git@git.secos.mobi:9932/all_projects/ins_emu/examiner.git
######## unicorn #########
Python found it in /home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/unicorn
Pip version unicorn 1.0.2rc4
Git info:
	Current commit 496667ee2ec614c60d28000ba88f77a8303daeee from branch master
	Checked out from remote origin: ssh://git@git.secos.mobi:9932/all_projects/ins_emu/examiner.git
######### Native Module Info ##########
angr: <CDLL '/home/xtyi/opensource/angr-dev/angr/angr/lib/angr_native.so', handle 210c7e0 at 0x7f52ee56b190>
unicorn: <CDLL '/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/unicorn/lib/libunicorn.so', handle 17c8630 at 0x7f52f4427250>
pyvex: <cffi.api._make_ffi_library.<locals>.FFILibrary object at 0x7f52f5039ca0>
z3: <CDLL '/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/z3/lib/libz3.so', handle 1a1e7b0 at 0x7f52f1e12fa0>
```


**To Reproduce.**
```
import angr
from angr.sim_options import (
    ZERO_FILL_UNCONSTRAINED_REGISTERS,
    ZERO_FILL_UNCONSTRAINED_MEMORY,
)

code_address = 0x20000
proj = angr.load_shellcode(
    b"\xc0\x07\xbb\xf3",
    arch="arm",
    thumb=False,
    load_address=code_address,
)

state: angr.SimState = proj.factory.call_state(addr=code_address)
state.options.add(ZERO_FILL_UNCONSTRAINED_REGISTERS)
state.options.add(ZERO_FILL_UNCONSTRAINED_MEMORY)
succ = state.step(num_inst=1)
```

**Additional context.**
<!--
Add any other context about the problem here.
-->



Discussion:

Resolving patch:
diff --git a/angr/engines/vex/claripy/irop.py b/angr/engines/vex/claripy/irop.py
--- a/angr/engines/vex/claripy/irop.py
+++ b/angr/engines/vex/claripy/irop.py
@@ -866,13 +866,33 @@ def _op_fp_to_fp(self, args):
         return arg.raw_to_fp().to_fp(claripy.fp.FSort.from_size(self._output_size_bits), rm=rm)
 
     def _op_fp_to_int(self, args):
-        rm = self._translate_rm(args[0])
-        arg = args[1].raw_to_fp()
+        if self.name.endswith("_RZ"):
+            rm = claripy.fp.RM_TowardsZero
+            arg = args[0]
+        elif self.name.endswith("_RN"):
+            rm = claripy.fp.RM_NearestTiesEven
+            arg = args[0]
+        elif self.name.endswith("_RM"):
+            rm = claripy.fp.RM_TowardsNegativeInf
+            arg = args[0]
+        elif self.name.endswith("_RP"):
+            rm = claripy.fp.RM_TowardsPositiveInf
+            arg = args[0]
+        else:
+            rm = self._translate_rm(args[0])
+            arg = args[1]
+
+        if not self._vector_size:
+            return self._compute_fp_to_int(rm, arg.raw_to_fp(), self._to_size)
+        else:
+            vector_args = arg.chop(self._vector_size)
+            return claripy.Concat(*[self._compute_fp_to_int(rm, varg.raw_to_fp(), self._vector_size) for varg in vector_args])
 
+    def _compute_fp_to_int(self, rm, arg, to_size):
         if self._to_signed == 'S':
-            return claripy.fpToSBV(rm, arg, self._to_size)
+            return claripy.fpToSBV(rm, arg, to_size)
         else:
-            return claripy.fpToUBV(rm, arg, self._to_size)
+            return claripy.fpToUBV(rm, arg, to_size)
 
     def _op_fgeneric_Cmp(self, args): #pylint:disable=no-self-use
 


Test patch: