Editing assembly instruction dialog causes segmentation fault

[Ty3r0X]

Environment information

• Operating System: arch
• Cutter version: 2.3.4-makepkg-209c26b
• Obtained from:
  • Built from source
  • Downloaded release from Cutter website or GitHub
  • Distribution repository
• File format: pe64
• Arch: x86
• Type: DLL (Dynamic Link Library)

Describe the bug

If I try to modify an assembly instruction using right click->Edit->Instruction I am greeted with the dialog prompting me to enter the new instruction. After pressing any key inside the text box, the program causes a segmentation fault without any warning.

To Reproduce

Steps to reproduce the behavior:

1. Go to a function
2. Go to Graph
3. Select an assembly instruction
4. Right click
5. Click on edit
6. Click instruction
7. When prompted to type the new instruction, try modifying the instruction itself, not the argument
8. crash

Expected behavior

Properly change the assembly instruction

Screenshots

Additional context

➜  ~ cutter /home/ty3r0x/projects/bios-rveng/wifi.bin 
"0.7.3" "0.7.3"
Plugins are loaded from "/home/ty3r0x/.local/share/rizin/cutter/plugins"
Native plugins are loaded from "/home/ty3r0x/.local/share/rizin/cutter/plugins/native"
Python plugins are loaded from "/home/ty3r0x/.local/share/rizin/cutter/plugins/python"
Loaded 0 plugin(s).
Plugins are loaded from "/usr/local/share/rizin/cutter/plugins"
Plugins are loaded from "/usr/share/rizin/cutter/plugins"
Native plugins are loaded from "/usr/share/rizin/cutter/plugins/native"
Loaded 1 plugin(s).
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls
[x] Analyze len bytes of instructions for references
[x] Check for classes
[x] Analyze local variables and arguments
[x] Type matching analysis for all functions
[x] Applied 0 FLIRT signatures via sigdb
[x] Propagate noreturn information
[x] Integrate dwarf function information.
[x] Resolve pointers to data sections
[x] Use -AA or aaaa to perform additional experimental analysis.
[1]    206376 segmentation fault (core dumped)  cutter /home/ty3r0x/projects/bios-rveng/wifi.bin

[wargio]

can you repro this with any binary?
Please also try the AppImage just in case.

[Ty3r0X]

can you repro this with any binary? Please also try the AppImage just in case.

The issue occours on any kind of binary, however the appimage version does not have this issue, I can change the instruction no problem. Does that mean this issue is the responsability of the package maintainer?

[wargio]

it might be.
unfortunately is hard to say without a crash dump.

[ravenexp]

I have the same issue, also on Arch Linux. Cutter version: cutter 2.3.4-makepkg-209c26b.

The backtrace looks as follows:

#0  0x00007f4054ad7a99 in rz_hex_bin2str (in=<optimized out>, len=<optimized out>, 
    out=<optimized out>) at ../librz/util/hex.c:397
#1  rz_hex_bin2str (in=<optimized out>, len=0, out=<optimized out>) at ../librz/util/hex.c:387
#2  0x00005a5d1f2a9f81 in CutterCore::bytesToHexString (bytes=...)
    at /usr/src/debug/rz-cutter/cutter/src/core/Cutter.cpp:4325
#3  0x00005a5d1f2d41ff in EditInstructionDialog::updatePreview (this=0x7ffc4c075e70, 
    input=...) at /usr/src/debug/rz-cutter/cutter/src/dialogs/EditInstructionDialog.cpp:66

And the interesting part seems to be:

#3  0x00005a5d1f2d41ff in EditInstructionDialog::updatePreview (this=0x7ffc4c075e70, 
    input=...) at /usr/src/debug/rz-cutter/cutter/src/dialogs/EditInstructionDialog.cpp:66
66              result = CutterCore::bytesToHexString(data).trimmed();
(gdb) p data
$6 = {d = {d = 0x0, ptr = 0x0, size = 0}}
(gdb) l
61          } else if (editMode == EDIT_BYTES) {
62              QByteArray data = CutterCore::hexStringToBytes(input);
63              result = Core()->disassemble(data).replace('\n', "; ");
64          } else if (editMode == EDIT_TEXT) {
65              QByteArray data = Core()->assemble(input);
66              result = CutterCore::bytesToHexString(data).trimmed();
67          }
68
69          if (result.isEmpty() || result.contains("invalid")) {
70              ui->instructionLabel->setText("Unknown Instruction");

It looks like Core()->assemble(input); returns nullptr as the result when the instruction edit box is empty, but the display code does not account for this.