Repository: angr/angr

Issue:
CFG party foul: improper propagation of returning status
*Disclaimer: The angr suite is maintained by a small team of volunteers. While we cannot guarantee any timeliness for fixes and enhancements, we will do our best. For more real-time help with angr, from us and the community, join our [Slack.](http://angr.io/invite/)*

---

**Describe the bug**
Please include a clear and concise description of what the bug is.
(binary attached)
mbed::mbed_fdopen (0x08005275) gets chopped off by its call to memcpy(0x08004de1).  memcpy gets figured out correctly, the caller is marked as nonreturning, and truncates at the call (same goes for a bunch of other stuff calling memcpy, from what i can tell)
I suspect this has something to do with memcpy being a bit of a tangle in the CFG, but I'm not sure why.


**Environment Information**

Many common issues are caused by problems with the local Python environment.
Before submitting, double-check that your versions of all modules in the angr suite (angr, cle, pyvex, ...) are up to date.
Please include the output of `python -m angr.misc.bug_report` here.
```
angr environment report
=============================
Date: 2018-10-18 21:47:05.735269
Running in virtual environment at /home/edg/.virtualenvs/angr-pypy3
Platform: linux-x86_64
Python version: 3.5.3 (fdd60ed87e94, Apr 24 2018, 06:10:04)
[PyPy 6.0.0 with GCC 6.2.0 20160901]
######## angr #########
Python found it in /home/edg/code/angr-py3k/angr/angr
Pip version angr 8.18.10.1
Git info:
	Current commit 89ca42745fa548436ad05e68ffa469f7ceac23d5 from branch fix/arm_cfg_party_2
	Checked out from remote origin: git@github.com:angr/angr
######## ailment #########
Python found it in /home/edg/code/angr-py3k/ailment/ailment
Pip version ailment 8.18.10.1
Git info:
	Current commit db8dea661a45044fd32795df86715053f6da12e9 from branch fix/clinic_clinic
Could not resolve tracking branch or remote info!
######## cle #########
Python found it in /home/edg/code/angr-py3k/cle/cle
Pip version cle 8.18.10.1
Git info:
	Current commit 70601f8cc273982e9a72fa7a3427b2b37ff2f65e from branch fix/arm_cfg_party_2
	Checked out from remote origin: git@github.com:angr/cle
######## pyvex #########
Python found it in /home/edg/code/angr-py3k/pyvex/pyvex
Pip version pyvex 8.18.10.5
Git info:
	Current commit aa9f19ef4143acb73c65cdfa7b7d2c0e9765fbf7 from branch fix/arm_cfg_party_2
	Checked out from remote origin: git@github.com:angr/pyvex
######## claripy #########
Python found it in /home/edg/code/angr-py3k/claripy/claripy
Pip version claripy 8.18.10.1
Git info:
	Current commit 49336fa3d3ad0ed941a47ab9ed8edbd86c2d2386 from branch master
	Checked out from remote origin: git@github.com:angr/claripy
######## archinfo #########
Python found it in /home/edg/.virtualenvs/angr-pypy3/site-packages/archinfo
Pip version archinfo 8.18.10.5
Couldn't find git info
######## ana #########
Python found it in /home/edg/code/angr-py3k/ana/ana
Pip version ana 0.5
Git info:
	Current commit 48657dc6500e33f5818b98003f1f179bfe03e1cc from branch master
	Checked out from remote origin: https://git:@github.com/zardus/ana
######## z3 #########
Python found it in /home/edg/.virtualenvs/angr-pypy3/site-packages/z3
Pip version not found!
Couldn't find git info
######## unicorn #########
Python found it in /home/edg/.virtualenvs/angr-pypy3/site-packages/unicorn
Pip version unicorn 1.0.1
Couldn't find git info
######### Native Module Info ##########
angr: <CDLL '/home/edg/code/angr-py3k/angr/angr/lib/angr_native.so', handle 2dcf500 at 0x7f34296599b8>
unicorn: <CDLL '/home/edg/.virtualenvs/angr-pypy3/site-packages/unicorn/lib/libunicorn.so', handle 25d0990 at 0x7f342ca67e50>
pyvex: <cffi.api._make_ffi_library.<locals>.FFILibrary object at 0x00007f342d8e79b8>
z3: <CDLL '/home/edg/.virtualenvs/angr-pypy3/site-packages/z3/lib/libz3.so', handle 4b91540 at 0x4b1d328>
```

**To Reproduce**
Please include *both a script to reproduce the crash, and attach the binary used, if possible*

```python
p = angr.Project('crappy_firmware.elf')
cfg = p.analyses.CFGFast(force_complete_scan=False, resolve_indirect_jumps=True, normalize=True)
f = p.kb.functions['_ZN4mbed11mbed_fdopenEPNS_10FileHandleEPKc']
assert len(list(f.blocks)) == 4 # I think?
```


[crappy_firmware.zip](https://github.com/angr/angr/files/2494529/crappy_firmware.zip)
**Additional context**
Add any other context about the problem here.

Isn't ARM great?


Discussion:
Did you post the correct binary? I do not find the function `mbed::mbed_fdopen()` in your binary.
You're right, here's the correct one
[crappy_firmware2.zip](https://github.com/angr/angr/files/2496702/crappy_firmware2.zip)
Edit: Updated the script above, too, don't sleep and code folks!

Resolving patch:
diff --git a/angr/analyses/cfg/cfg_fast.py b/angr/analyses/cfg/cfg_fast.py
--- a/angr/analyses/cfg/cfg_fast.py
+++ b/angr/analyses/cfg/cfg_fast.py
@@ -639,11 +639,17 @@ def __init__(self, src_node, dst_addr, src_func_addr, to_outside=False, dst_func
         self.ins_addr = ins_addr
 
     def apply(self, cfg):
+        to_outside = self.to_outside
+        if not to_outside:
+            # is it jumping to outside? Maybe we are seeing more functions now.
+            dst_node = cfg.get_any_node(self.dst_addr)
+            if dst_node is not None and dst_node.function_address != self.src_func_addr:
+                to_outside = True
         return cfg._function_add_transition_edge(
             self.dst_addr,
             self.src_node,
             self.src_func_addr,
-            to_outside=self.to_outside,
+            to_outside=to_outside,
             dst_func_addr=self.dst_func_addr,
             stmt_idx=self.stmt_idx,
             ins_addr=self.ins_addr,


Test patch: