angr 9.2.141__py3-none-macosx_11_0_arm64.whl → 9.2.143__py3-none-macosx_11_0_arm64.whl

angr/analyses/s_propagator.py

@@ -26,6 +26,7 @@ from angr.utils.ssa import (
     get_vvar_deflocs,
     has_ite_expr,
     has_ite_stmt,
+    has_tmp_expr,
     is_phi_assignment,
     is_const_assignment,
     is_const_and_vvar_assignment,
@@ -126,7 +127,7 @@ class SPropagatorAnalysis(Analysis):
         # update vvar_deflocs using function arguments
         if self.func_args:
             for func_arg in self.func_args:
-                vvar_deflocs[func_arg] = ExternalCodeLocation()
+                vvar_deflocs[func_arg.varid] = func_arg, ExternalCodeLocation()
 
         # find all ret sites and indirect jump sites
         retsites: set[tuple[int, int | None, int]] = set()
@@ -143,11 +144,11 @@ class SPropagatorAnalysis(Analysis):
         # find constant and other propagatable assignments
         vvarid_to_vvar = {}
         const_vvars: dict[int, Const] = {}
-        for vvar, defloc in vvar_deflocs.items():
+        for vvar_id, (vvar, defloc) in vvar_deflocs.items():
             if not vvar.was_reg and not vvar.was_parameter:
                 continue
 
-            vvarid_to_vvar[vvar.varid] = vvar
+            vvarid_to_vvar[vvar_id] = vvar
             if isinstance(defloc, ExternalCodeLocation):
                 continue
 
@@ -160,8 +161,8 @@ class SPropagatorAnalysis(Analysis):
             if r:
                 # replace wherever it's used
                 assert v is not None
-                const_vvars[vvar.varid] = v
-                for vvar_at_use, useloc in vvar_uselocs[vvar.varid]:
+                const_vvars[vvar_id] = v
+                for vvar_at_use, useloc in vvar_uselocs[vvar_id]:
                     replacements[useloc][vvar_at_use] = v
                 continue
 
@@ -189,10 +190,10 @@ class SPropagatorAnalysis(Analysis):
         if self.mode == "function":
             assert self.func_graph is not None
 
-            for vvar, defloc in vvar_deflocs.items():
-                if vvar.varid not in vvar_uselocs:
+            for vvar_id, (vvar, defloc) in vvar_deflocs.items():
+                if vvar_id not in vvar_uselocs:
                     continue
-                if vvar.varid in const_vvars:
+                if vvar_id in const_vvars:
                     continue
                 if isinstance(defloc, ExternalCodeLocation):
                     continue
@@ -200,11 +201,13 @@ class SPropagatorAnalysis(Analysis):
                 assert defloc.block_addr is not None
                 assert defloc.stmt_idx is not None
 
+                vvar_uselocs_set = set(vvar_uselocs[vvar_id])  # deduplicate
+
                 block = blocks[(defloc.block_addr, defloc.block_idx)]
                 stmt = block.statements[defloc.stmt_idx]
                 if (
                     (vvar.was_reg or vvar.was_parameter)
-                    and len(vvar_uselocs[vvar.varid]) <= 2
+                    and len(vvar_uselocs_set) <= 2
                     and isinstance(stmt, Assignment)
                     and isinstance(stmt.src, Load)
                 ):
@@ -215,43 +218,46 @@ class SPropagatorAnalysis(Analysis):
                     #       v1 = v0 + 1;
                     #    }
                     can_replace = True
-                    for _, vvar_useloc in vvar_uselocs[vvar.varid]:
+                    for _, vvar_useloc in vvar_uselocs_set:
                         if has_store_stmt_in_between_stmts(self.func_graph, blocks, defloc, vvar_useloc):
                             can_replace = False
 
                     if can_replace:
                         # we can propagate this load because there is no store between its def and use
-                        for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                        for vvar_used, vvar_useloc in vvar_uselocs_set:
                             replacements[vvar_useloc][vvar_used] = stmt.src
                         continue
 
                 if (
                     (vvar.was_reg or vvar.was_stack)
-                    and len(vvar_uselocs[vvar.varid]) == 2
+                    and len(vvar_uselocs_set) == 2
+                    and isinstance(stmt, Assignment)
                     and not is_phi_assignment(stmt)
                 ):
                     # a special case: in a typical switch-case construct, a variable may be used once for comparison
                     # for the default case and then used again for constructing the jump target. we can propagate this
                     # variable for such cases.
-                    uselocs = {loc for _, loc in vvar_uselocs[vvar.varid]}
-                    if self.is_vvar_used_for_addr_loading_switch_case(uselocs, blocks):
-                        for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                    uselocs = {loc for _, loc in vvar_uselocs_set}
+                    if self.is_vvar_used_for_addr_loading_switch_case(uselocs, blocks) and not has_tmp_expr(stmt.src):
+                        for vvar_used, vvar_useloc in vvar_uselocs_set:
                             replacements[vvar_useloc][vvar_used] = stmt.src
                         # mark the vvar as dead and should be removed
                         self.model.dead_vvar_ids.add(vvar.varid)
                         continue
 
                 if vvar.was_reg or vvar.was_parameter:
-                    if len(vvar_uselocs[vvar.varid]) == 1:
-                        vvar_used, vvar_useloc = next(iter(vvar_uselocs[vvar.varid]))
-                        if is_const_vvar_load_assignment(stmt) and not has_store_stmt_in_between_stmts(
-                            self.func_graph, blocks, defloc, vvar_useloc
+                    if len(vvar_uselocs_set) == 1:
+                        vvar_used, vvar_useloc = next(iter(vvar_uselocs_set))
+                        if (
+                            is_const_vvar_load_assignment(stmt)
+                            and not has_store_stmt_in_between_stmts(self.func_graph, blocks, defloc, vvar_useloc)
+                            and not has_tmp_expr(stmt.src)
                         ):
                             # we can propagate this load because there is no store between its def and use
                             replacements[vvar_useloc][vvar_used] = stmt.src
                             continue
 
-                        if is_const_and_vvar_assignment(stmt):
+                        if is_const_and_vvar_assignment(stmt) and not has_tmp_expr(stmt.src):
                             # if the useloc is a phi assignment statement, ensure that stmt.src is the same as the phi
                             # variable
                             assert vvar_useloc.block_addr is not None
@@ -273,18 +279,22 @@ class SPropagatorAnalysis(Analysis):
                     else:
                         non_exitsite_uselocs = [
                             loc
-                            for _, loc in vvar_uselocs[vvar.varid]
+                            for _, loc in vvar_uselocs_set
                             if (loc.block_addr, loc.block_idx, loc.stmt_idx) not in (retsites | jumpsites)
                         ]
                         if is_const_and_vvar_assignment(stmt):
                             if len(non_exitsite_uselocs) == 1:
                                 # this vvar is used once if we exclude its uses at ret sites or jump sites. we can
                                 # propagate it
-                                for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                                for vvar_used, vvar_useloc in vvar_uselocs_set:
                                     replacements[vvar_useloc][vvar_used] = stmt.src
                                 continue
 
-                            if len(set(non_exitsite_uselocs)) == 1 and not has_ite_expr(stmt.src):
+                            if (
+                                len(set(non_exitsite_uselocs)) == 1
+                                and not has_ite_expr(stmt.src)
+                                and not has_tmp_expr(stmt.src)
+                            ):
                                 useloc = non_exitsite_uselocs[0]
                                 assert useloc.block_addr is not None
                                 assert useloc.stmt_idx is not None
@@ -292,13 +302,13 @@ class SPropagatorAnalysis(Analysis):
                                 if stmt.src.depth <= 3 and not has_ite_stmt(useloc_stmt):
                                     # remove duplicate use locs (e.g., if the variable is used multiple times by the
                                     # same statement) - but ensure stmt is simple enough
-                                    for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                                    for vvar_used, vvar_useloc in vvar_uselocs_set:
                                         replacements[vvar_useloc][vvar_used] = stmt.src
                                     continue
 
                 # special logic for global variables: if it's used once or multiple times, and the variable is never
                 # updated before it's used, we will propagate the load
-                if (vvar.was_reg or vvar.was_parameter) and isinstance(stmt, Assignment):
+                if (vvar.was_reg or vvar.was_parameter) and isinstance(stmt, Assignment) and not has_tmp_expr(stmt.src):
                     stmt_src = stmt.src
                     # unpack conversions
                     while isinstance(stmt_src, Convert):
@@ -309,7 +319,7 @@ class SPropagatorAnalysis(Analysis):
                         and isinstance(stmt_src.addr.value, int)
                     ):
                         gv_updated = False
-                        for _vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                        for _vvar_used, vvar_useloc in vvar_uselocs_set:
                             gv_updated |= self.is_global_variable_updated(
                                 self.func_graph,
                                 blocks,
@@ -320,12 +330,13 @@ class SPropagatorAnalysis(Analysis):
                                 vvar_useloc,
                             )
                         if not gv_updated:
-                            for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                            for vvar_used, vvar_useloc in vvar_uselocs_set:
                                 replacements[vvar_useloc][vvar_used] = stmt.src
                             continue
 
         for vvar_id, uselocs in vvar_uselocs.items():
             vvar = next(iter(uselocs))[0] if vvar_id not in vvarid_to_vvar else vvarid_to_vvar[vvar_id]
+            vvar_uselocs_set = set(uselocs)  # deduplicate
 
             if self._sp_tracker is not None and vvar.category == VirtualVariableCategory.REGISTER:
                 if vvar.oident == self.project.arch.sp_offset:
@@ -334,7 +345,7 @@ class SPropagatorAnalysis(Analysis):
                         if "sp" in self.project.arch.registers
                         else None
                     )
-                    for vvar_at_use, useloc in vvar_uselocs[vvar.varid]:
+                    for vvar_at_use, useloc in vvar_uselocs_set:
                         sb_offset = self._sp_tracker.offset_before(useloc.ins_addr, self.project.arch.sp_offset)
                         if sb_offset is not None:
                             v = StackBaseOffset(None, self.project.arch.bits, sb_offset)
@@ -349,7 +360,7 @@ class SPropagatorAnalysis(Analysis):
                         if "bp" in self.project.arch.registers
                         else None
                     )
-                    for vvar_at_use, useloc in vvar_uselocs[vvar.varid]:
+                    for vvar_at_use, useloc in vvar_uselocs_set:
                         sb_offset = self._sp_tracker.offset_before(useloc.ins_addr, self.project.arch.bp_offset)
                         if sb_offset is not None:
                             v = StackBaseOffset(None, self.project.arch.bits, sb_offset)

angr/analyses/s_reaching_definitions/s_rda_model.py

@@ -20,26 +20,35 @@ class SRDAModel:
         self.func_args = func_args
         self.arch = arch
         self.varid_to_vvar: dict[int, VirtualVariable] = {}
-        self.all_vvar_definitions: dict[VirtualVariable, CodeLocation] = {}
-        self.all_vvar_uses: dict[VirtualVariable, set[tuple[VirtualVariable | None, CodeLocation]]] = defaultdict(set)
+        self.all_vvar_definitions: dict[int, CodeLocation] = {}
+        self.all_vvar_uses: dict[int, list[tuple[VirtualVariable | None, CodeLocation]]] = defaultdict(list)
         self.all_tmp_definitions: dict[CodeLocation, dict[atoms.Tmp, int]] = defaultdict(dict)
         self.all_tmp_uses: dict[CodeLocation, dict[atoms.Tmp, set[tuple[Tmp, int]]]] = defaultdict(dict)
         self.phi_vvar_ids: set[int] = set()
         self.phivarid_to_varids: dict[int, set[int]] = {}
+        self.vvar_uses_by_loc: dict[CodeLocation, list[int]] = {}
+
+    def add_vvar_use(self, vvar_id: int, expr: VirtualVariable | None, loc: CodeLocation) -> None:
+        self.all_vvar_uses[vvar_id].append((expr, loc))
+        if loc not in self.vvar_uses_by_loc:
+            self.vvar_uses_by_loc[loc] = []
+        self.vvar_uses_by_loc[loc].append(vvar_id)
 
     @property
     def all_definitions(self) -> Generator[Definition]:
-        for vvar, defloc in self.all_vvar_definitions.items():
-            yield Definition(atoms.VirtualVariable(vvar.varid, vvar.size, vvar.category, vvar.oident), defloc)
+        for vvar_id, defloc in self.all_vvar_definitions.items():
+            vvar = self.varid_to_vvar[vvar_id]
+            yield Definition(atoms.VirtualVariable(vvar_id, vvar.size, vvar.category, vvar.oident), defloc)
 
     def is_phi_vvar_id(self, idx: int) -> bool:
         return idx in self.phi_vvar_ids
 
     def get_all_definitions(self, block_loc: CodeLocation) -> set[Definition]:
         s = set()
-        for vvar, codeloc in self.all_vvar_definitions.items():
+        for vvar_id, codeloc in self.all_vvar_definitions.items():
+            vvar = self.varid_to_vvar[vvar_id]
             if codeloc.block_addr == block_loc.block_addr and codeloc.block_idx == block_loc.block_idx:
-                s.add(Definition(atoms.VirtualVariable(vvar.varid, vvar.size, vvar.category, vvar.oident), codeloc))
+                s.add(Definition(atoms.VirtualVariable(vvar_id, vvar.size, vvar.category, vvar.oident), codeloc))
         return s | self.get_all_tmp_definitions(block_loc)
 
     def get_all_tmp_definitions(self, block_loc: CodeLocation) -> set[Definition]:
@@ -64,43 +73,45 @@ class SRDAModel:
         :return:        A set of definitions that are used at the given location.
         """
         if exprs:
-            defs: set[tuple[Definition, Any]] = set()
-            for vvar, uses in self.all_vvar_uses.items():
-                for expr, loc_ in uses:
-                    if loc_ == loc:
-                        defs.add(
-                            (
-                                Definition(
-                                    atoms.VirtualVariable(vvar.varid, vvar.size, vvar.category, vvar.oident),
-                                    self.all_vvar_definitions[vvar],
-                                ),
-                                expr,
-                            )
-                        )
-            return defs
-
-        defs: set[Definition] = set()
-        for vvar, uses in self.all_vvar_uses.items():
-            for _, loc_ in uses:
-                if loc_ == loc:
-                    defs.add(
+            def_with_exprs: set[tuple[Definition, Any]] = set()
+            if loc not in self.vvar_uses_by_loc:
+                return def_with_exprs
+            for vvar_id in self.vvar_uses_by_loc[loc]:
+                vvar = self.varid_to_vvar[vvar_id]
+                def_with_exprs.add(
+                    (
                         Definition(
-                            atoms.VirtualVariable(vvar.varid, vvar.size, vvar.category, vvar.oident),
-                            self.all_vvar_definitions[vvar],
-                        )
+                            atoms.VirtualVariable(vvar_id, vvar.size, vvar.category, vvar.oident),
+                            self.all_vvar_definitions[vvar_id],
+                        ),
+                        vvar,
                     )
+                )
+            return def_with_exprs
+
+        defs: set[Definition] = set()
+        if loc not in self.vvar_uses_by_loc:
+            return defs
+        for vvar_id in self.vvar_uses_by_loc[loc]:
+            vvar = self.varid_to_vvar[vvar_id]
+            defs.add(
+                Definition(
+                    atoms.VirtualVariable(vvar_id, vvar.size, vvar.category, vvar.oident),
+                    self.all_vvar_definitions[vvar_id],
+                )
+            )
         return defs
 
-    def get_vvar_uses(self, obj: atoms.VirtualVariable) -> set[CodeLocation]:
-        the_vvar = self.varid_to_vvar.get(obj.varid, None)
-        if the_vvar is not None:
-            return {loc for _, loc in self.all_vvar_uses[the_vvar]}
+    def get_vvar_uses(self, obj: VirtualVariable | atoms.VirtualVariable) -> set[CodeLocation]:
+        if obj.varid in self.all_vvar_uses:
+            return {loc for _, loc in self.all_vvar_uses[obj.varid]}
         return set()
 
-    def get_vvar_uses_with_expr(self, obj: atoms.VirtualVariable) -> set[tuple[CodeLocation, VirtualVariable]]:
-        the_vvar = self.varid_to_vvar.get(obj.varid, None)
-        if the_vvar is not None:
-            return {(loc, expr) for expr, loc in self.all_vvar_uses[the_vvar]}
+    def get_vvar_uses_with_expr(
+        self, obj: VirtualVariable | atoms.VirtualVariable
+    ) -> set[tuple[VirtualVariable | None, CodeLocation]]:
+        if obj.varid in self.all_vvar_uses:
+            return set(self.all_vvar_uses[obj.varid])
         return set()
 
     def get_tmp_uses(self, obj: atoms.Tmp, block_loc: CodeLocation) -> set[CodeLocation]:

angr/analyses/s_reaching_definitions/s_rda_view.py

@@ -185,7 +185,10 @@ class SRDAView:
                             vvars.append(func_arg)
         # there might be multiple vvars; we prioritize the one whose size fits the best
         for v in vvars:
-            if v.stack_offset == stack_offset and v.size == size:
+            if (
+                (v.was_stack and v.stack_offset == stack_offset)
+                or (v.was_parameter and v.parameter_stack_offset == stack_offset)
+            ) and v.size == size:
                 return v
         return vvars[0] if vvars else None
 
@@ -239,9 +242,9 @@ class SRDAView:
         return vvars[0] if vvars else None
 
     def get_vvar_value(self, vvar: VirtualVariable) -> Expression | None:
-        if vvar not in self.model.all_vvar_definitions:
+        if vvar.varid not in self.model.all_vvar_definitions:
             return None
-        codeloc = self.model.all_vvar_definitions[vvar]
+        codeloc = self.model.all_vvar_definitions[vvar.varid]
 
         for block in self.model.func_graph:
             if block.addr == codeloc.block_addr and block.idx == codeloc.block_idx:

angr/analyses/s_reaching_definitions/s_reaching_definitions.py

@@ -63,7 +63,7 @@ class SReachingDefinitionsAnalysis(Analysis):
             case _:
                 raise NotImplementedError
 
-        phi_vvars = {}
+        phi_vvars: dict[int, set[int]] = {}
         # find all vvar definitions
         vvar_deflocs = get_vvar_deflocs(blocks.values(), phi_vvars=phi_vvars)
         # find all explicit vvar uses
@@ -72,34 +72,35 @@ class SReachingDefinitionsAnalysis(Analysis):
         # update vvar definitions using function arguments
         if self.func_args:
             for vvar in self.func_args:
-                if vvar not in vvar_deflocs:
-                    vvar_deflocs[vvar] = ExternalCodeLocation()
+                if vvar.varid not in vvar_deflocs:
+                    vvar_deflocs[vvar.varid] = vvar, ExternalCodeLocation()
             self.model.func_args = self.func_args
 
         # update model
-        for vvar, defloc in vvar_deflocs.items():
-            self.model.varid_to_vvar[vvar.varid] = vvar
-            self.model.all_vvar_definitions[vvar] = defloc
-
-            for vvar_at_use, useloc in vvar_uselocs[vvar.varid]:
-                self.model.all_vvar_uses[vvar].add((vvar_at_use, useloc))
-
-        self.model.phi_vvar_ids = {vvar.varid for vvar in phi_vvars}
+        for vvar_id, (vvar, defloc) in vvar_deflocs.items():
+            self.model.varid_to_vvar[vvar_id] = vvar
+            self.model.all_vvar_definitions[vvar_id] = defloc
+            if vvar_id in vvar_uselocs:
+                for useloc in vvar_uselocs[vvar_id]:
+                    self.model.add_vvar_use(vvar_id, *useloc)
+
+        self.model.phi_vvar_ids = set(phi_vvars)
         self.model.phivarid_to_varids = {}
-        for vvar, src_vvars in phi_vvars.items():
-            self.model.phivarid_to_varids[vvar.varid] = {
-                src_vvar.varid for src_vvar in src_vvars if src_vvar is not None
-            }
+        for vvar_id, src_vvars in phi_vvars.items():
+            self.model.phivarid_to_varids[vvar_id] = src_vvars
 
         if self.mode == "function":
+
             # fix register definitions for arguments
-            defined_vvarids = {vvar.varid for vvar in vvar_deflocs}
+            defined_vvarids = set(vvar_deflocs)
             undefined_vvarids = set(vvar_uselocs.keys()).difference(defined_vvarids)
             for vvar_id in undefined_vvarids:
                 used_vvar = next(iter(vvar_uselocs[vvar_id]))[0]
-                self.model.varid_to_vvar[used_vvar.varid] = used_vvar
-                self.model.all_vvar_definitions[used_vvar] = ExternalCodeLocation()
-                self.model.all_vvar_uses[used_vvar] |= vvar_uselocs[vvar_id]
+                self.model.varid_to_vvar[vvar_id] = used_vvar
+                self.model.all_vvar_definitions[vvar_id] = ExternalCodeLocation()
+                if vvar_id in vvar_uselocs:
+                    for vvar_useloc in vvar_uselocs[vvar_id]:
+                        self.model.add_vvar_use(vvar_id, *vvar_useloc)
 
             srda_view = SRDAView(self.model)
 
@@ -151,8 +152,7 @@ class SReachingDefinitionsAnalysis(Analysis):
                         reg_offset = self.project.arch.registers[arg_reg_name][0]
                         if reg_offset in reg_to_vvarids:
                             vvarid = reg_to_vvarids[reg_offset]
-                            vvar = self.model.varid_to_vvar[vvarid]
-                            self.model.all_vvar_uses[vvar].add((None, codeloc))
+                            self.model.add_vvar_use(vvarid, None, codeloc)
 
         if self._track_tmps:
             # track tmps

angr/analyses/typehoon/simple_solver.py

@@ -185,7 +185,9 @@ class Sketch:
             return self.node_mapping[typevar]
         node: SketchNodeBase | None = None
         if isinstance(typevar, DerivedTypeVariable):
-            node = self.node_mapping[SimpleSolver._to_typevar_or_typeconst(typevar.type_var)]
+            t = SimpleSolver._to_typevar_or_typeconst(typevar.type_var)
+            assert isinstance(t, TypeVariable)
+            node = self.node_mapping[t]
             for label in typevar.labels:
                 succs = []
                 for _, dst, data in self.graph.out_edges(node, data=True):
@@ -210,11 +212,26 @@ class Sketch:
         # sub <: super
         if not isinstance(constraint, Subtype):
             return
-        subtype = self.flatten_typevar(constraint.sub_type)
-        supertype = self.flatten_typevar(constraint.super_type)
+        subtype, _ = self.flatten_typevar(constraint.sub_type)
+        supertype, try_maxsize = self.flatten_typevar(constraint.super_type)
+
+        if (
+            try_maxsize
+            and isinstance(subtype, TypeVariable)
+            and subtype in self.solver.stackvar_max_sizes
+            and isinstance(supertype, TypeConstant)
+            and not isinstance(supertype, BottomType)
+        ):
+            basetype = supertype
+            assert basetype.size is not None
+            max_size = self.solver.stackvar_max_sizes.get(subtype, None)
+            if max_size not in {0, None} and max_size // basetype.size > 0:  # type: ignore
+                supertype = Array(element=basetype, count=max_size // basetype.size)  # type: ignore
+
         if SimpleSolver._typevar_inside_set(subtype, PRIMITIVE_TYPES) and not SimpleSolver._typevar_inside_set(
             supertype, PRIMITIVE_TYPES
         ):
+            assert isinstance(supertype, (TypeVariable, DerivedTypeVariable))
             super_node = self.lookup(supertype)
             assert super_node is None or isinstance(super_node, SketchNode)
             if super_node is not None:
@@ -222,6 +239,7 @@ class Sketch:
         elif SimpleSolver._typevar_inside_set(supertype, PRIMITIVE_TYPES) and not SimpleSolver._typevar_inside_set(
             subtype, PRIMITIVE_TYPES
         ):
+            assert isinstance(subtype, (TypeVariable, DerivedTypeVariable))
             sub_node = self.lookup(subtype)
             assert sub_node is None or isinstance(sub_node, SketchNode)
             # assert sub_node is not None
@@ -231,7 +249,7 @@ class Sketch:
     @staticmethod
     def flatten_typevar(
         derived_typevar: TypeVariable | TypeConstant | DerivedTypeVariable,
-    ) -> DerivedTypeVariable | TypeVariable | TypeConstant:
+    ) -> tuple[DerivedTypeVariable | TypeVariable | TypeConstant, bool]:
         # pylint:disable=too-many-boolean-expressions
         if (
             isinstance(derived_typevar, DerivedTypeVariable)
@@ -243,8 +261,10 @@ class Sketch:
             and derived_typevar.labels[1].offset == 0
             and derived_typevar.labels[1].bits == MAX_POINTSTO_BITS
         ):
-            return derived_typevar.type_var.basetype
-        return derived_typevar
+            bt = derived_typevar.type_var.basetype
+            assert bt is not None
+            return bt, True
+        return derived_typevar, False
 
 
 #
@@ -313,6 +333,11 @@ class ConstraintGraphNode:
             else:
                 prefix = DerivedTypeVariable(self.typevar.type_var, None, labels=self.typevar.labels[:-1])
             variance = Variance.COVARIANT if self.variance == last_label.variance else Variance.CONTRAVARIANT
+            if not isinstance(prefix, (TypeVariable, DerivedTypeVariable)):
+                # we may see incorrectly generated type constraints that attempt to load from an int:
+                #   int64.load
+                # we don't want to entertain such constraints
+                return None
             return (
                 ConstraintGraphNode(prefix, variance, self.tag, FORGOTTEN.PRE_FORGOTTEN),
                 self.typevar.labels[-1],
@@ -330,6 +355,7 @@ class ConstraintGraphNode:
             raise TypeError(f"Unsupported type {type(self.typevar)}")
         variance = Variance.COVARIANT if self.variance == label.variance else Variance.CONTRAVARIANT
         var = typevar if not labels else DerivedTypeVariable(typevar, None, labels=labels)
+        assert isinstance(var, (TypeVariable, DerivedTypeVariable))
         return ConstraintGraphNode(var, variance, self.tag, FORGOTTEN.PRE_FORGOTTEN)
 
     def inverse(self) -> ConstraintGraphNode:
@@ -366,13 +392,14 @@ class SimpleSolver:
     improvements.
     """
 
-    def __init__(self, bits: int, constraints, typevars):
+    def __init__(self, bits: int, constraints, typevars, stackvar_max_sizes: dict[TypeVariable, int] | None = None):
         if bits not in (32, 64):
             raise ValueError(f"Pointer size {bits} is not supported. Expect 32 or 64.")
 
         self.bits = bits
         self._constraints: dict[TypeVariable, set[TypeConstraint]] = constraints
         self._typevars: set[TypeVariable] = typevars
+        self.stackvar_max_sizes = stackvar_max_sizes if stackvar_max_sizes is not None else {}
         self._base_lattice = BASE_LATTICES[bits]
         self._base_lattice_inverted = networkx.DiGraph()
         for src, dst in self._base_lattice.edges:
@@ -1289,7 +1316,7 @@ class SimpleSolver:
             for _, succ, data in out_edges:
                 if isinstance(succ, RecursiveRefNode):
                     ref = succ
-                    succ: SketchNode | None = sketch.lookup(succ.target)
+                    succ: SketchNode | None = sketch.lookup(succ.target)  # type: ignore
                     if succ is None:
                         # failed to resolve...
                         _l.warning(

angr/analyses/typehoon/typehoon.py

@@ -37,6 +37,7 @@ class Typehoon(Analysis):
         ground_truth=None,
         var_mapping: dict[SimVariable, set[TypeVariable]] | None = None,
         must_struct: set[TypeVariable] | None = None,
+        stackvar_max_sizes: dict[TypeVariable, int] | None = None,
     ):
         """
 
@@ -52,6 +53,7 @@ class Typehoon(Analysis):
         self._ground_truth: dict[TypeVariable, SimType] | None = ground_truth
         self._var_mapping = var_mapping
         self._must_struct = must_struct
+        self._stackvar_max_sizes = stackvar_max_sizes if stackvar_max_sizes is not None else {}
 
         self.bits = self.project.arch.bits
         self.solution = None
@@ -163,7 +165,7 @@ class Typehoon(Analysis):
                         typevars.add(constraint.sub_type)
                     if isinstance(constraint.super_type, TypeVariable):
                         typevars.add(constraint.super_type)
-        solver = SimpleSolver(self.bits, self._constraints, typevars)
+        solver = SimpleSolver(self.bits, self._constraints, typevars, stackvar_max_sizes=self._stackvar_max_sizes)
         self.solution = solver.solution
 
     def _specialize(self):

angr/analyses/variable_recovery/engine_ail.py

@@ -143,9 +143,9 @@ class SimEngineVRAIL(
             # this is a dynamically calculated call target
             target_expr = self._expr(target)
             funcaddr_typevar = target_expr.typevar
-            assert funcaddr_typevar is not None
-            load_typevar = self._create_access_typevar(funcaddr_typevar, False, self.arch.bytes, 0)
-            self.state.add_type_constraint(typevars.Subtype(funcaddr_typevar, load_typevar))
+            if funcaddr_typevar is not None:
+                load_typevar = self._create_access_typevar(funcaddr_typevar, False, self.arch.bytes, 0)
+                self.state.add_type_constraint(typevars.Subtype(funcaddr_typevar, load_typevar))
 
         # discover the prototype
         prototype: SimTypeFunction | None = None
@@ -212,9 +212,9 @@ class SimEngineVRAIL(
             # this is a dynamically calculated call target
             target_expr = self._expr(target)
             funcaddr_typevar = target_expr.typevar
-            assert funcaddr_typevar is not None
-            load_typevar = self._create_access_typevar(funcaddr_typevar, False, self.arch.bytes, 0)
-            self.state.add_type_constraint(typevars.Subtype(funcaddr_typevar, load_typevar))
+            if funcaddr_typevar is not None:
+                load_typevar = self._create_access_typevar(funcaddr_typevar, False, self.arch.bytes, 0)
+                self.state.add_type_constraint(typevars.Subtype(funcaddr_typevar, load_typevar))
 
         # discover the prototype
         prototype: SimTypeFunction | None = None