Cutter: Segfault while analyzing MIPS binary

[enovella]

Work environment

| Questions | Answers
|------------------------------------------------------|--------------------
| OS/arch/bits (mandatory) | Ubuntu 18.04 LTS x64
| File format of the file you reverse (mandatory) | ELF
| Architecture/bits of the file (mandatory) | MIPS
| Cutter and r2 version, See About Cutter (mandatory) | Version 1.6 / Using r2 2.7.0
| Show version information full output (See About Cutter) in a pastebin document (mandatory) | https://ghostbin.com/paste/5g2zo

Expected behavior

Binary analized

Actual behavior

Segmentation fault

Steps to reproduce the behavior

• Private DM only. Binary isn't shareable

Additional Logs, screenshots, source-code, configuration dump, ...

$ ./Cutter-v1.6-x86_64.AppImage 
Setting r2 prefix = "/tmp/.mount_CutterbLVdK1/usr"  for AppImage.
Setting PYTHONHOME = "/tmp/.mount_CutterbLVdK1/usr"  for AppImage.
PYTHONHOME = "/tmp/.mount_CutterbLVdK1/usr"
[[I 10:20:27.090 CutterNotebookApp] 302 GET /?token=5bbde00c7c42f627cb851f5eb90dd12da4b8988b3dbb6871 (127.0.0.1) 1.30ms
[x] Analyze all flags starting with sym. and entry0 (aa)
[ ] 
[Value from 0x00400000 to 0x004056f4
aav: 0x00400000-0x004056f4 in 0x400000-0x4056f4
aav: 0x00400000-0x004056f4 in 0x4456f4-0x445940
Value from 0x004456f4 to 0x00445940
aav: 0x004456f4-0x00445940 in 0x400000-0x4056f4
aav: 0x004456f4-0x00445940 in 0x4456f4-0x445940
[[E 10:20:27.240 CutterNotebookApp] Could not open static file '/tmp/.mount_CutterbLVdK1/usr/lib/python3.6/site-packages/notebook/static/components/proptypes/index.js'
[E 10:20:27.241 CutterNotebookApp] Could not open static file '/tmp/.mount_CutterbLVdK1/usr/lib/python3.6/site-packages/notebook/static/components/preact-compat/index.js'
WARNING:traitlets:Error loading kernelspec 'python3'
Traceback (most recent call last):
  File "<frozen importlib._bootstrap_external>", line 833, in get_data
OSError: [Errno 9] Bad file descriptor

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/tmp/.mount_CutterbLVdK1/usr/lib/python3.6/site-packages/jupyter_client/kernelspec.py", line 258, in get_all_specs
    spec = self._get_kernel_spec_by_name(kname, resource_dir)
  File "/tmp/.mount_CutterbLVdK1/usr/lib/python3.6/site-packages/jupyter_client/kernelspec.py", line 193, in _get_kernel_spec_by_name
    from ipykernel.kernelspec import RESOURCES, get_kernel_dict
  File "/tmp/.mount_CutterbLVdK1/usr/lib/python3.6/site-packages/ipykernel/__init__.py", line 2, in <module>
    from .connect import *
  File "<frozen importlib._bootstrap>", line 971, in _find_and_load
  File "<frozen importlib._bootstrap>", line 955, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 665, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 674, in exec_module
  File "<frozen importlib._bootstrap_external>", line 780, in get_code
  File "<frozen importlib._bootstrap_external>", line 833, in get_data
OSError: [Errno 9] Bad file descriptor
[15072:15088:0716/102027.659428:ERROR:sandbox_ipc_linux.cc(415)] sendmsg: Socket operation on non-socket
[15072:15088:0716/102027.675139:ERROR:sandbox_ipc_linux.cc(415)] sendmsg: Bad file descriptor
[x] Analyze function calls (aac)
[[15072:15088:0716/102027.675172:FATAL:scoped_file.cc(40)] Check failed: 0 == ret. : Bad file descriptor
#0 0x7f32f9c2f3ae <unknown>
#1 0x7f32f9c3f4b7 <unknown>
#2 0x7f32f9c3f6d9 <unknown>
#3 0x7f32f9c3c36d <unknown>
#4 0x7f32f97ebab4 <unknown>
#5 0x7f32f97ebd37 <unknown>
#6 0x7f32f9c7b270 <unknown>
#7 0x7f32f9c778ad <unknown>
#8 0x7f32ff7c46db start_thread
#9 0x7f32fff1588f clone

Aborted (core dumped)

[enovella]

The problem seems to be the path where the binary is located. The bin has permissions as well as the path itself.

Moving the binary to /tmp solves the issue, Cutter doesn't crash and the binary is analysed.

[kugel-]

I have the same problem. Moving to /tmp does not help.

[kugel-]

It does not crash if I manually select MIPS in the advanced options. It seems the arch autodetection is at fault.

[xarkes]

Thanks for the details. Will look again tonight.

[enovella]

For me modifying the arch didn't solve the issue but it solved if I disabled the auto-analysis.

[xarkes]

Btw the stacktrace seems similar to https://github.com/radareorg/cutter/issues/647

[xarkes]

I think it is random and because of the integrated QtWebEngine. If I comment this line https://github.com/radareorg/cutter/blob/3cd71f75e154328dcc5069a42fdc8ce92b901371/src/widgets/JupyterWidget.cpp#L108 it seems not to happen anymore...
I don't really know what's the cause for now.

[thestr4ng3r]

Seems to be related to threads and QtWebEngine. I was able to create a minimal example that shows the crash: https://github.com/thestr4ng3r/r2-webengine-crash
Compile this and run it a few times and it might crash.

[thestr4ng3r]

Correction: not related to threads, I can reproduce it without a thread now too.

[enovella]

hi @thestr4ng3r,
let me know if you need the binary.

[xarkes]

Should be fixed with #728

[thestr4ng3r]

Follow-up: https://github.com/radare/radare2/issues/11693