Skip to content

Fix 3 bugs: backward fixed-point, PPC calling convention, ashr >64-bit#125

Merged
endeav0r merged 2 commits into
masterfrom
fix/backward-fixedpoint-ppc-cc-ashr-bugs
Mar 13, 2026
Merged

Fix 3 bugs: backward fixed-point, PPC calling convention, ashr >64-bit#125
endeav0r merged 2 commits into
masterfrom
fix/backward-fixedpoint-ppc-cc-ashr-bugs

Conversation

@endeav0r

Copy link
Copy Markdown
Member

Summary

Second-pass code review of the Falcon binary analysis framework, finding 3 bugs with test coverage for each.

  • Backward fixed-point analysis started from entry instead of exit (fixed_point.rs:157): fixed_point_backward_options called .entry() on the CFG instead of .exit(), causing backward analysis to visit only the entry block (which has no predecessors) and terminate immediately. The variable was correctly named exit_index — the author intended .exit(). Added Error::FixedPointRequiresExit variant for the correct error message.
  • PPC calling convention return registers swapped (calling_convention.rs:380,389): return_address_type was set to r3 and return_register to lr, but per PPC32 SVR4 ABI, lr holds the return address and r3 holds the return value. This would cause analysis to misidentify return branch targets and miss return value data flow.
  • Constant::ashr incorrect for >64-bit values (constant.rs:309): Sign-extension fill mask was hardcoded to u64::MAX (64 1-bits). For 128-bit values shifted right by more than 64, the fill pattern was too short, leaving upper bits as 0 instead of 1. Now constructs a properly-sized all-ones mask matching the value's bit width, consistent with how Constant::sext handles this.

Test plan

  • backward_analysis_starts_from_exit — builds a 2-block CFG (entry→exit), runs backward analysis, asserts exit block is visited
  • ppc_return_address_is_lr — creates PPC calling convention, asserts return address register is lr and return value register is r3
  • constant_ashr_128bit — shifts 0x80...0:128 right by 96, asserts correct 96-bit sign extension
  • All 216 tests pass (cargo test)

🤖 Generated with Claude Code

endeavor and others added 2 commits March 13, 2026 09:08
…4-bit

- Backward fixed-point analysis started from CFG entry instead of exit,
  causing it to visit only 1-2 locations instead of the entire function.
  Added FixedPointRequiresExit error variant for clarity.
- PPC calling convention had return_address_type (lr) and return_register
  (r3) swapped, misidentifying branch targets and return value data flow.
- Constant::ashr sign-extension used u64::MAX (64 1-bits) which is
  insufficient for >64-bit values; now scales to any bit width.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@endeav0r
endeav0r merged commit 5ead46a into master Mar 13, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant