Repository: angr/angr

Issue:
CFGFast fails: ValueError: You can't fit a integral value of size 6 into an argument of size 4!
<!--
*Disclaimer:
The angr suite is maintained by a small team of volunteers.
While we cannot guarantee any timeliness for fixes and enhancements, we will do our best.
For more real-time help with angr, from us and the community, join our [Slack.](http://angr.io/invite/)*
-->
---

**Describe the bug.**
<!--
Please include a clear and concise description of what the bug is.
-->
Hi, I'm trying to migrate the [karonte project](https://github.com/ucsb-seclab/karonte) to angr 8. But CFGFast fails on many binaries from the provided testcase.
This is the test scirpt I used:
```python
import angr
import sys

def test_cfg(path):
    p = angr.Project(path, auto_load_libs=False)
    cfg = p.analyses.CFGFast(show_progressbar=False)

if __name__ == "__main__":
    test_cfg(sys.argv[1])
```
` firmware/d-link/analyzed/DIR-868L_fw_revA_1-12_eu_multi_20170316/fw/_DIR868LA1_FW112b04.bin.extracted/squashfs-root/htdocs/fileaccess.cgi` and `firmware/d-link/analyzed/DIR-868L_fw_revA_1-12_eu_multi_20170316/fw/_DIR868LA1_FW112b04.bin.extracted/squashfs-root/sbin/httpd` from the karonte testset as examples:
```
Traceback (most recent call last):
  File "test.py", line 9, in <module>
    test_cfg(sys.argv[1])
  File "test.py", line 6, in test_cfg
    cfg = p.analyses.CFGFast(show_progressbar=False)
  File "/home/angr/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 30, in __getitem__
    return super(FunctionDict, self).__getitem__(addr)
KeyError: 1049056

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "test.py", line 9, in <module>
    test_cfg(sys.argv[1])
  File "test.py", line 6, in test_cfg
    cfg = p.analyses.CFGFast(show_progressbar=False)
  File "/home/angr/angr-dev/angr/angr/analyses/analysis.py", line 115, in __call__
    oself.__init__(*args, **kwargs)
  File "/home/angr/angr-dev/angr/angr/analyses/cfg/cfg_fast.py", line 653, in __init__
    self._analyze()
  File "/home/angr/angr-dev/angr/angr/analyses/forward_analysis/forward_analysis.py", line 216, in _analyze
    self._analysis_core_baremetal()
  File "/home/angr/angr-dev/angr/angr/analyses/forward_analysis/forward_analysis.py", line 368, in _analysis_core_baremetal
    self._process_job_and_get_successors(job_info)
  File "/home/angr/angr-dev/angr/angr/analyses/forward_analysis/forward_analysis.py", line 386, in _process_job_and_get_successors
    successors = self._get_successors(job)
  File "/home/angr/angr-dev/angr/angr/analyses/cfg/cfg_fast.py", line 1076, in _get_successors
    jobs = self._scan_block(job)
  File "/home/angr/angr-dev/angr/angr/analyses/cfg/cfg_fast.py", line 1391, in _scan_block
    entries = self._scan_procedure(cfg_job, current_func_addr)
  File "/home/angr/angr-dev/angr/angr/analyses/cfg/cfg_fast.py", line 1441, in _scan_procedure
    self._function_add_node(cfg_node, current_func_addr)
  File "/home/angr/angr-dev/angr/angr/analyses/cfg/cfg_fast.py", line 3119, in _function_add_node
    self.kb.functions._add_node(function_addr, snippet)
  File "/home/angr/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 108, in _add_node
    dst_func = self._function_map[function_addr]
  File "/home/angr/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 38, in __getitem__
    t = Function(self._backref, addr)
  File "/home/angr/angr-dev/angr/angr/knowledge_plugins/functions/function.py", line 194, in __init__
    args = cc.arg_locs(is_fp=[False] * simproc.num_args)  # arg_locs() uses cc.args
  File "/home/angr/angr-dev/angr/angr/calling_conventions.py", line 526, in arg_locs
    return [session.next_arg(ifp, size=sz) for ifp, sz in zip(is_fp, sizes)]
  File "/home/angr/angr-dev/angr/angr/calling_conventions.py", line 526, in <listcomp>
    return [session.next_arg(ifp, size=sz) for ifp, sz in zip(is_fp, sizes)]
  File "/home/angr/angr-dev/angr/angr/calling_conventions.py", line 258, in next_arg
    arg = self.upsize_arg(arg, is_fp, size)
  File "/home/angr/angr-dev/angr/angr/calling_conventions.py", line 263, in upsize_arg
    raise ValueError("You can't fit a integral value of size %d into an argument of size %d!" % (size, arg.size))
ValueError: You can't fit a integral value of size 6 into an argument of size 4!
```

**Environment Information.**
<!--
Many common issues are caused by problems with the local Python environment.
Before submitting, double-check that your versions of all modules in the angr suite (angr, cle, pyvex, ...) are up to date.
Please include the output of `python -m angr.misc.bug_report` here.
-->
```
angr environment report
=============================
Date: 2020-06-01 04:51:04.864583
Running in virtual environment at /home/angr/.virtualenvs/angr
Platform: linux-x86_64
Python version: 3.6.9 (default, Apr 18 2020, 01:56:04) 
[GCC 8.4.0]
######## angr #########
Python found it in /home/angr/angr-dev/angr/angr
Pip version angr 8.20.5.27
Git info:
	Current commit 88eaf90373b632346020cac39c9caf6a51e3882d from branch master
	Checked out from remote origin: https://github.com/angr/angr
######## ailment #########
Python found it in /home/angr/angr-dev/ailment/ailment
Pip version ailment 8.20.5.27
Git info:
	Current commit 41283cfc056f74047cb19f6bf964d14ee1a63437 from branch master
	Checked out from remote origin: https://github.com/angr/ailment
######## cle #########
Python found it in /home/angr/angr-dev/cle/cle
Pip version cle 8.20.5.27
Git info:
	Current commit 4f133cb1c9bb389156175268eb1b989d76e4d280 from branch master
	Checked out from remote origin: https://github.com/angr/cle
######## pyvex #########
Python found it in /home/angr/angr-dev/pyvex/pyvex
Pip version pyvex 8.20.5.27
Git info:
	Current commit 7fb904e903be5d5a6a730241fa6b7c8c1c656218 from branch master
	Checked out from remote origin: https://github.com/angr/pyvex
######## claripy #########
Python found it in /home/angr/angr-dev/claripy/claripy
Pip version claripy 8.20.5.27
Git info:
	Current commit 59f0a4f3616b55b19f78e731c4717d2cac935b2c from branch master
	Checked out from remote origin: https://github.com/angr/claripy
######## archinfo #########
Python found it in /home/angr/angr-dev/archinfo/archinfo
Pip version archinfo 8.20.5.27
Git info:
	Current commit 548b35f1136b77e3b88f894d83f22293aa7225a2 from branch master
	Checked out from remote origin: https://github.com/angr/archinfo
######## z3 #########
Python found it in /home/angr/.virtualenvs/angr/lib/python3.6/site-packages/z3
Pip version z3-solver 4.8.8.0
Couldn't find git info
######## unicorn #########
Python found it in /home/angr/.virtualenvs/angr/lib/python3.6/site-packages/unicorn
Pip version unicorn 1.0.2
Couldn't find git info
######### Native Module Info ##########
angr: <CDLL '/home/angr/angr-dev/angr/angr/lib/angr_native.so', handle 3243740 at 0x7f791c1ee5c0>
unicorn: <CDLL '/home/angr/.virtualenvs/angr/lib/python3.6/site-packages/unicorn/lib/libunicorn.so', handle 25033c0 at 0x7f791b17ec50>
pyvex: <cffi.api._make_ffi_library.<locals>.FFILibrary object at 0x7f791c106da0>
z3: <CDLL '/home/angr/.virtualenvs/angr/lib/python3.6/site-packages/z3/lib/libz3.so', handle 271cef0 at 0x7f7917f4a198>
```


**To Reproduce.**
<!--
Please include *both a script to reproduce the crash, and attach the binary used, if possible*
-->
This is tested in the latest docker image from https://hub.docker.com/r/angr/angr, and the failed binaries can be downloaded here:

[binaries.zip](https://github.com/angr/angr/files/4709473/binaries.zip)



**Additional context.**
<!--
Add any other context about the problem here.
-->



Discussion:

Resolving patch:
diff --git a/angr/calling_conventions.py b/angr/calling_conventions.py
--- a/angr/calling_conventions.py
+++ b/angr/calling_conventions.py
@@ -512,7 +512,7 @@ def arg_locs(self, is_fp=None, sizes=None):
                 sizes = [ ]
                 for a in args:
                     if isinstance(a, SimType):
-                        if a.size is NotImplemented:
+                        if isinstance(a, SimTypeFixedSizeArray) or a.size is NotImplemented:
                             sizes.append(self.arch.bytes)
                         else:
                             sizes.append(a.size // 8)  # SimType.size is in bits


Test patch: