trailofbits/manticore

AttributeError: 'BoolConstant' object has no attribute 'operands'

Open

#485 opened on Sep 7, 2017

View on GitHub
 (2 comments) (0 reactions) (0 assignees)Python (3,469 stars) (481 forks)batch import
bughelp wantedneeds_reviewsmt

Description

OS / Environment

Docker: Ubuntu 16.04

Manticore version

Version: 0.1.4

Python version

Python 2.7.12

Dependencies

capstone==3.0.5rc2 manticore==0.1.4 ply==3.10 pyelftools==0.24 unicorn==1.0.1

Summary of the problem

Manticore fails with exception:

EXECUTOR:ERROR: Exception: 'BoolConstant' object has no attribute 'operands'
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/manticore/core/executor.py", line 466, in run
    self.fork(current_state, e.expression, e.policy, e.setstate)
  File "/usr/local/lib/python2.7/dist-packages/manticore/core/executor.py", line 379, in fork
    solutions = state.concretize(expression, policy)
  File "/usr/local/lib/python2.7/dist-packages/manticore/core/state.py", line 292, in concretize
    silent=False)
  File "/usr/local/lib/python2.7/dist-packages/manticore/core/smtlib/solver.py", line 346, in get_all_values
    temp_cs.add(var==expression)
  File "/usr/local/lib/python2.7/dist-packages/manticore/core/smtlib/constraints.py", line 51, in add
    constraint = arithmetic_simplifier(constraint)
  File "/usr/local/lib/python2.7/dist-packages/manticore/core/smtlib/visitors.py", line 472, in arithmetic_simplifier
    simp.visit(expression, use_fixed_point=True)
  File "/usr/local/lib/python2.7/dist-packages/manticore/core/smtlib/visitors.py", line 90, in visit
    value = self._method(new_node, *operands)
  File "/usr/local/lib/python2.7/dist-packages/manticore/core/smtlib/visitors.py", line 58, in _method
    value = getattr(self, methodname)(expression, *args)
  File "/usr/local/lib/python2.7/dist-packages/manticore/core/smtlib/visitors.py", line 316, in visit_Operation
    if self._changed(expression, operands):
  File "/usr/local/lib/python2.7/dist-packages/manticore/core/smtlib/visitors.py", line 310, in _changed
    return any( operands[i] is not expression.operands[i] for i in range(arity))
  File "/usr/local/lib/python2.7/dist-packages/manticore/core/smtlib/visitors.py", line 310, in <genexpr>
    return any( operands[i] is not expression.operands[i] for i in range(arity))
AttributeError: 'BoolConstant' object has no attribute 'operands'

expression is True in:

    @staticmethod
    def _changed(expression, operands):
        arity = len(operands)
        return any( operands[i] is not expression.operands[i] for i in range(arity))

Contributor guide

Tech stack
python
Domain
backend
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
PythonManticore internalsVisitor pattern
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
80
Research direction
The issue is in manticore/core/smtlib/visitors.py, in the ` changed` method of the `ArithmeticSimplifier` class. The method assumes `expression` is an `Operation` with `operands`, but it can be a `BoolConstant` when `expression` is `True`. The fix should check if `expression` is a `BoolConstant` (or does not have `operands`) before accessing `expression.operands`. Alternatively, the `visit Operation` method could be updated to handle this edge case. The traceback shows the error occurs during `arithmetic simplifier` in constraints.py line 51. A minimal fix would be to add an `isinstance` check for `BoolConstant` in ` changed` and return `False` (or handle appropriately).