angr 9.2.153__tar.gz → 9.2.154__tar.gz

{angr-9.2.153/angr.egg-info → angr-9.2.154}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: angr
-Version: 9.2.153
+Version: 9.2.154
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 License: BSD-2-Clause
 Project-URL: Homepage, https://angr.io/
@@ -17,13 +17,13 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cxxheaderparser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.153
-Requires-Dist: archinfo==9.2.153
+Requires-Dist: ailment==9.2.154
+Requires-Dist: archinfo==9.2.154
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.153
-Requires-Dist: cle==9.2.153
+Requires-Dist: claripy==9.2.154
+Requires-Dist: cle==9.2.154
 Requires-Dist: mulpyplexer
 Requires-Dist: networkx!=2.8.1,>=2.0
 Requires-Dist: protobuf>=5.28.2
@@ -31,7 +31,7 @@ Requires-Dist: psutil
 Requires-Dist: pycparser>=2.18
 Requires-Dist: pydemumble
 Requires-Dist: pyformlang
-Requires-Dist: pyvex==9.2.153
+Requires-Dist: pyvex==9.2.154
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy

{angr-9.2.153 → angr-9.2.154}/angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.153"
+__version__ = "9.2.154"
 
 if bytes is str:
     raise Exception(

{angr-9.2.153 → angr-9.2.154}/angr/analyses/analysis.py

@@ -5,7 +5,7 @@ import sys
 import contextlib
 from collections import defaultdict
 from inspect import Signature
-from typing import TYPE_CHECKING, TypeVar, Generic, cast
+from typing import TYPE_CHECKING, TypeVar, Generic, cast, Any
 from collections.abc import Callable
 from types import NoneType
 from itertools import chain
@@ -111,7 +111,7 @@ class AnalysisLogEntry:
 A = TypeVar("A", bound="Analysis")
 
 
-class AnalysesHub(PluginVendor[A]):
+class AnalysesHub(PluginVendor[Any]):
     """
     This class contains functions for all the registered and runnable analyses,
     """
@@ -123,7 +123,7 @@ class AnalysesHub(PluginVendor[A]):
     def _init_plugin(self, plugin_cls: type[A]) -> AnalysisFactory[A]:
         return AnalysisFactory(self.project, plugin_cls)
 
-    def __getstate__(self):
+    def __getstate__(self):  # type: ignore[reportIncompatibleMethodOverride]
         s = super().__getstate__()
         return (s, self.project)
 

{angr-9.2.153 → angr-9.2.154}/angr/analyses/calling_convention/fact_collector.py

@@ -6,7 +6,6 @@ from collections import defaultdict
 import pyvex
 import claripy
 
-from angr import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
 from angr.utils.bits import s2u, u2s
 from angr.block import Block
 from angr.analyses.analysis import Analysis
@@ -15,7 +14,8 @@ from angr.knowledge_plugins.functions import Function
 from angr.codenode import BlockNode, HookNode
 from angr.engines.light import SimEngineNostmtVEX, SimEngineLight, SpOffset, RegisterOffset
 from angr.calling_conventions import SimRegArg, SimStackArg, default_cc
-from angr.sim_type import SimTypeBottom, dereference_simtype, SimTypeFunction
+from angr.sim_type import SimTypeBottom, SimTypeFunction
+from angr.utils.types import dereference_simtype_by_lib
 from .utils import is_sane_register_variable
 
 if TYPE_CHECKING:
@@ -121,7 +121,7 @@ class SimEngineFactCollectorVEX(
         if self.block.vex.jumpkind == "Ijk_Call" and self.arch.ret_offset is not None:
             self.state.register_written(self.arch.ret_offset, self.arch.bytes)
 
-    def _top(self, bits: int):
+    def _top(self, bits: int):  # type: ignore
         return None
 
     def _is_top(self, expr: Any) -> bool:
@@ -190,13 +190,13 @@ class SimEngineFactCollectorVEX(
         self.state.register_read(expr.offset, bits // self.arch.byte_width)
         return RegisterOffset(bits, expr.offset, 0)
 
-    def _handle_expr_GetI(self, expr):
+    def _handle_expr_GetI(self, expr):  # type: ignore
         return None
 
-    def _handle_expr_ITE(self, expr):
+    def _handle_expr_ITE(self, expr):  # type: ignore
         return None
 
-    def _handle_expr_Load(self, expr):
+    def _handle_expr_Load(self, expr):  # type: ignore
         addr = self._expr(expr.addr)
         if isinstance(addr, SpOffset):
             self.state.stack_read(addr.offset, expr.result_size(self.tyenv) // self.arch.byte_width)
@@ -206,7 +206,7 @@ class SimEngineFactCollectorVEX(
     def _handle_expr_RdTmp(self, expr):
         return self.state.tmps.get(expr.tmp, None)
 
-    def _handle_expr_VECRET(self, expr):
+    def _handle_expr_VECRET(self, expr):  # type: ignore
         return None
 
     @binop_handler
@@ -444,13 +444,7 @@ class FactCollector(Analysis):
                             proto = func_succ.prototype
                             if func_succ.prototype_libname is not None:
                                 # we need to deref the prototype in case it uses SimTypeRef internally
-                                type_collections = []
-                                for prototype_lib in SIM_LIBRARIES[func_succ.prototype_libname]:
-                                    if prototype_lib.type_collection_names:
-                                        for typelib_name in prototype_lib.type_collection_names:
-                                            type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
-                                if type_collections:
-                                    proto = dereference_simtype(proto, type_collections)
+                                proto = dereference_simtype_by_lib(proto, func_succ.prototype_libname)
 
                             assert isinstance(proto, SimTypeFunction) and proto.returnty is not None
                             returnty_size = proto.returnty.with_arch(self.project.arch).size

{angr-9.2.153 → angr-9.2.154}/angr/analyses/cfg/cfg_fast.py

@@ -1567,7 +1567,7 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                     block = func.get_block(func.addr)
                 except SimTranslationError:
                     block = None
-                if block is not None and block.instructions == 1:
+                if block is not None and block.instructions == 1 and len(block.capstone.insns) == 1:
                     insn = block.capstone.insns[0]
                     if block.bytes == b"\xff\xe0":
                         func.info["jmp_rax"] = True
@@ -1921,7 +1921,7 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                     if cfg_node is None:
                         continue
                     func_addr = cfg_node.function_address
-                    if func_addr not in tested_func_addrs:
+                    if func_addr not in tested_func_addrs and self.kb.functions.contains_addr(func_addr):
                         func = self.kb.functions.get_by_addr(func_addr)
                         if not security_check_cookie_found and is_function_security_check_cookie(
                             func, self.project, security_cookie_addr

{angr-9.2.153 → angr-9.2.154}/angr/analyses/decompiler/callsite_maker.py

@@ -1,5 +1,5 @@
 from __future__ import annotations
-from typing import Any, TYPE_CHECKING
+from typing import cast, Any, TYPE_CHECKING
 import copy
 import logging
 
@@ -14,7 +14,6 @@ from angr.sim_type import (
     SimTypeChar,
     SimTypeInt,
     SimTypeFloat,
-    dereference_simtype,
     SimTypeFunction,
     SimTypeLongLong,
 )
@@ -22,7 +21,7 @@ from angr.calling_conventions import SimReferenceArgument, SimRegArg, SimStackAr
 from angr.knowledge_plugins.key_definitions.constants import OP_BEFORE
 from angr.analyses import Analysis, register_analysis
 from angr.analyses.s_reaching_definitions import SRDAView
-from angr import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
+from angr.utils.types import dereference_simtype_by_lib
 
 if TYPE_CHECKING:
     from angr.knowledge_plugins.functions import Function
@@ -37,12 +36,14 @@ class CallSiteMaker(Analysis):
     Add calling convention, declaration, and args to a call site.
     """
 
-    def __init__(self, block, reaching_definitions=None, stack_pointer_tracker=None, ail_manager: Manager = None):
+    def __init__(
+        self, block, reaching_definitions=None, stack_pointer_tracker=None, ail_manager: Manager | None = None
+    ):
         self.block = block
 
         self._reaching_definitions = reaching_definitions
         self._stack_pointer_tracker = stack_pointer_tracker
-        self._ail_manager = ail_manager
+        self._ail_manager: Manager | None = ail_manager
 
         self.result_block = None
         self.stack_arg_offsets: set[tuple[int, int]] | None = None  # call ins addr, stack_offset
@@ -109,16 +110,8 @@ class CallSiteMaker(Analysis):
             # make sure the function prototype is resolved.
             # TODO: Cache resolved function prototypes globally
             prototype_libname = func.prototype_libname
-            type_collections = []
             if prototype_libname is not None:
-                for prototype_lib in SIM_LIBRARIES[prototype_libname]:
-                    if prototype_lib.type_collection_names:
-                        for typelib_name in prototype_lib.type_collection_names:
-                            type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
-            if type_collections:
-                prototype = dereference_simtype(prototype, type_collections).with_arch(  # type: ignore
-                    self.project.arch
-                )
+                prototype = cast(SimTypeFunction, dereference_simtype_by_lib(prototype, prototype_libname))
 
         args = []
         arg_vvars = []
@@ -151,6 +144,10 @@ class CallSiteMaker(Analysis):
                     # across registers). most importantly, a ComboArg represents one variable, not multiple, but we
                     # have no way to know that until later down the pipeline.
                     expanded_arg_locs += arg_loc.locations
+                elif isinstance(arg_loc, SimStructArg):
+                    expanded_arg_locs += [  # type: ignore
+                        arg_loc.locs[field_name] for field_name in arg_loc.struct.fields if field_name in arg_loc.locs
+                    ]
                 elif isinstance(arg_loc, (SimRegArg, SimStackArg, SimReferenceArgument)):
                     expanded_arg_locs.append(arg_loc)
                 else:
@@ -195,12 +192,15 @@ class CallSiteMaker(Analysis):
                         if vvar_def_reg_offset is not None and offset > vvar_def_reg_offset:
                             # we need to shift the value
                             vvar_use = Expr.BinaryOp(
-                                self._ail_manager.next_atom(),
+                                self._ail_manager.next_atom() if self._ail_manager is not None else None,
                                 "Shr",
                                 [
                                     vvar_use,
                                     Expr.Const(
-                                        self._ail_manager.next_atom(), None, (offset - vvar_def_reg_offset) * 8, 8
+                                        self._ail_manager.next_atom() if self._ail_manager is not None else None,
+                                        None,
+                                        (offset - vvar_def_reg_offset) * 8,
+                                        8,
                                     ),
                                 ],
                                 **vvar_use.tags,
@@ -208,7 +208,7 @@ class CallSiteMaker(Analysis):
                         if vvar_def.size > arg_loc.size:
                             # we need to narrow the value
                             vvar_use = Expr.Convert(
-                                self._ail_manager.next_atom(),
+                                self._ail_manager.next_atom() if self._ail_manager is not None else None,
                                 vvar_use.bits,
                                 arg_loc.size * self.project.arch.byte_width,
                                 False,

angr-9.2.154/angr/analyses/decompiler/ccall_rewriters/x86_ccalls.py

@@ -0,0 +1,278 @@
+from __future__ import annotations
+
+from ailment import Expr
+
+from angr.engines.vex.claripy.ccall import data
+from .rewriter_base import CCallRewriterBase
+
+
+X86_CondTypes = data["X86"]["CondTypes"]
+X86_OpTypes = data["X86"]["OpTypes"]
+X86_CondBitMasks = data["X86"]["CondBitMasks"]
+X86_CondBitOffsets = data["X86"]["CondBitOffsets"]
+
+
+class X86CCallRewriter(CCallRewriterBase):
+    """
+    Implements VEX ccall rewriter for X86.
+
+    From libVEX:
+
+    A summary of the field usages is:
+
+    Operation          DEP1               DEP2               NDEP
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+    add/sub/mul        first arg          second arg         unused
+    adc/sbb            first arg          (second arg)
+                                          XOR old_carry      old_carry
+    and/or/xor         result             zero               unused
+    inc/dec            result             zero               old_carry
+    shl/shr/sar        result             subshifted-        unused
+                                          result
+    rol/ror            result             zero               old_flags
+    copy               old_flags          zero               unused.
+    """
+
+    __slots__ = ()
+
+    def _rewrite(self, ccall: Expr.VEXCCallExpression) -> Expr.Expression | None:
+        if ccall.callee == "x86g_calculate_condition":
+            cond = ccall.operands[0]
+            op = ccall.operands[1]
+            dep_1 = ccall.operands[2]
+            dep_2 = ccall.operands[3]
+            if isinstance(cond, Expr.Const) and isinstance(op, Expr.Const):
+                cond_v = cond.value
+                op_v = op.value
+                if cond_v == X86_CondTypes["CondLE"]:
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_SUBB"],
+                        X86_OpTypes["G_CC_OP_SUBW"],
+                        X86_OpTypes["G_CC_OP_SUBL"],
+                    }:
+                        # dep_1 <=s dep_2
+                        dep_1 = self._fix_size(
+                            dep_1,
+                            op_v,
+                            X86_OpTypes["G_CC_OP_SUBB"],
+                            X86_OpTypes["G_CC_OP_SUBW"],
+                            ccall.tags,
+                        )
+                        dep_2 = self._fix_size(
+                            dep_2,
+                            op_v,
+                            X86_OpTypes["G_CC_OP_SUBB"],
+                            X86_OpTypes["G_CC_OP_SUBW"],
+                            ccall.tags,
+                        )
+
+                        r = Expr.BinaryOp(ccall.idx, "CmpLE", (dep_1, dep_2), True, **ccall.tags)
+                        return Expr.Convert(None, r.bits, ccall.bits, False, r, **ccall.tags)
+                elif cond_v == X86_CondTypes["CondO"]:
+                    op_v = op.value
+                    ret_cond = None
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_UMULB"],
+                        X86_OpTypes["G_CC_OP_UMULW"],
+                        X86_OpTypes["G_CC_OP_UMULL"],
+                    }:
+                        # dep_1 * dep_2 >= max_signed_byte/word/dword
+                        ret = Expr.BinaryOp(
+                            None,
+                            "Mul",
+                            (dep_1, dep_2),
+                            bits=dep_1.bits * 2,
+                            **ccall.tags,
+                        )
+                        max_signed = Expr.Const(
+                            None,
+                            None,
+                            (1 << (dep_1.bits - 1)),
+                            bits=dep_1.bits * 2,
+                            **ccall.tags,
+                        )
+                        ret_cond = Expr.BinaryOp(None, "CmpGE", (ret, max_signed), signed=False, **ccall.tags)
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_INCB"],
+                        X86_OpTypes["G_CC_OP_INCW"],
+                        X86_OpTypes["G_CC_OP_INCL"],
+                    }:
+                        # dep_1 is the result
+                        overflowed = Expr.Const(
+                            None,
+                            None,
+                            1 << (dep_1.bits - 1),
+                            dep_1.bits,
+                            **ccall.tags,
+                        )
+                        ret_cond = Expr.BinaryOp(None, "CmpEQ", (dep_1, overflowed), **ccall.tags)
+
+                    if ret_cond is not None:
+                        return Expr.ITE(
+                            ccall.idx,
+                            ret_cond,
+                            Expr.Const(None, None, 0, 1, **ccall.tags),
+                            Expr.Const(None, None, 1, 1, **ccall.tags),
+                            **ccall.tags,
+                        )
+                elif cond_v == X86_CondTypes["CondZ"]:
+                    op_v = op.value
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_ADDB"],
+                        X86_OpTypes["G_CC_OP_ADDW"],
+                        X86_OpTypes["G_CC_OP_ADDL"],
+                    }:
+                        # dep_1 + dep_2 == 0
+                        ret = Expr.BinaryOp(
+                            None,
+                            "Add",
+                            (dep_1, dep_2),
+                            bits=dep_1.bits,
+                            **ccall.tags,
+                        )
+                        zero = Expr.Const(
+                            None,
+                            None,
+                            0,
+                            dep_1.bits,
+                            **ccall.tags,
+                        )
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpEQ",
+                            (ret, zero),
+                            True,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_SUBB"],
+                        X86_OpTypes["G_CC_OP_SUBW"],
+                        X86_OpTypes["G_CC_OP_SUBL"],
+                    }:
+                        # dep_1 - dep_2 == 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpEQ",
+                            (dep_1, dep_2),
+                            True,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_LOGICB"],
+                        X86_OpTypes["G_CC_OP_LOGICW"],
+                        X86_OpTypes["G_CC_OP_LOGICL"],
+                    }:
+                        # dep_1 == 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpEQ",
+                            (dep_1, Expr.Const(None, None, 0, dep_1.bits, **ccall.tags)),
+                            True,
+                            **ccall.tags,
+                        )
+                elif cond_v == X86_CondTypes["CondL"]:
+                    op_v = op.value
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_SUBB"],
+                        X86_OpTypes["G_CC_OP_SUBW"],
+                        X86_OpTypes["G_CC_OP_SUBL"],
+                    }:
+                        # dep_1 - dep_2 < 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLT",
+                            (dep_1, dep_2),
+                            True,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_LOGICB"],
+                        X86_OpTypes["G_CC_OP_LOGICW"],
+                        X86_OpTypes["G_CC_OP_LOGICL"],
+                    }:
+                        # dep_1 < 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLT",
+                            (dep_1, Expr.Const(None, None, 0, dep_1.bits, **ccall.tags)),
+                            True,
+                            **ccall.tags,
+                        )
+                elif cond_v in {
+                    X86_CondTypes["CondBE"],
+                    X86_CondTypes["CondB"],
+                }:
+                    op_v = op.value
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_ADDB"],
+                        X86_OpTypes["G_CC_OP_ADDW"],
+                        X86_OpTypes["G_CC_OP_ADDL"],
+                    }:
+                        # dep_1 + dep_2 <= 0  if CondBE
+                        # dep_1 + dep_2 < 0   if CondB
+                        ret = Expr.BinaryOp(
+                            None,
+                            "Add",
+                            (dep_1, dep_2),
+                            signed=False,
+                            bits=dep_1.bits,
+                            **ccall.tags,
+                        )
+                        zero = Expr.Const(
+                            None,
+                            None,
+                            0,
+                            dep_1.bits,
+                            **ccall.tags,
+                        )
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLE" if cond_v == X86_CondTypes["CondBE"] else "CmpLT",
+                            (ret, zero),
+                            False,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_SUBB"],
+                        X86_OpTypes["G_CC_OP_SUBW"],
+                        X86_OpTypes["G_CC_OP_SUBL"],
+                    }:
+                        # dep_1 <= dep_2  if CondBE
+                        # dep_1 < dep_2   if CondB
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLE" if cond_v == X86_CondTypes["CondBE"] else "CmpLT",
+                            (dep_1, dep_2),
+                            False,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_LOGICB"],
+                        X86_OpTypes["G_CC_OP_LOGICW"],
+                        X86_OpTypes["G_CC_OP_LOGICL"],
+                    }:
+                        # dep_1 <= 0  if CondBE
+                        # dep_1 < 0   if CondB
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLE" if cond_v == X86_CondTypes["CondBE"] else "CmpLT",
+                            (dep_1, Expr.Const(None, None, 0, dep_1.bits, **ccall.tags)),
+                            False,
+                            **ccall.tags,
+                        )
+        return None
+
+    @staticmethod
+    def _fix_size(expr, op_v: int, type_8bit, type_16bit, tags):
+        if op_v == type_8bit:
+            bits = 8
+        elif op_v == type_16bit:
+            bits = 16
+        else:
+            bits = 32
+        if bits < 32:
+            if isinstance(expr, Expr.Const):
+                return Expr.Const(expr.idx, None, expr.value & ((1 << bits) - 1), bits, **tags)
+            return Expr.Convert(None, 32, bits, False, expr, **tags)
+        return expr

{angr-9.2.153 → angr-9.2.154}/angr/analyses/decompiler/clinic.py

@@ -12,7 +12,6 @@ import networkx
 import capstone
 
 import ailment
-from angr import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
 
 from angr.errors import AngrDecompilationError
 from angr.knowledge_base import KnowledgeBase
@@ -22,9 +21,9 @@ from angr.knowledge_plugins.key_definitions import atoms
 from angr.codenode import BlockNode
 from angr.utils import timethis
 from angr.utils.graph import GraphUtils
+from angr.utils.types import dereference_simtype_by_lib
 from angr.calling_conventions import SimRegArg, SimStackArg, SimFunctionArgument
 from angr.sim_type import (
-    dereference_simtype,
     SimTypeChar,
     SimTypeInt,
     SimTypeLongLong,
@@ -1240,16 +1239,8 @@ class Clinic(Analysis):
                 # make sure the function prototype is resolved.
                 # TODO: Cache resolved function prototypes globally
                 prototype_libname = func.prototype_libname
-                type_collections = []
                 if prototype_libname is not None:
-                    for prototype_lib in SIM_LIBRARIES[prototype_libname]:
-                        if prototype_lib.type_collection_names:
-                            for typelib_name in prototype_lib.type_collection_names:
-                                type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
-                if type_collections:
-                    prototype = dereference_simtype(prototype, type_collections).with_arch(  # type: ignore
-                        self.project.arch
-                    )
+                    prototype = dereference_simtype_by_lib(prototype, prototype_libname)
 
             if cc is None:
                 l.warning("Call site %#x (callee %s) has an unknown calling convention.", block.addr, repr(func))
@@ -1541,6 +1532,7 @@ class Clinic(Analysis):
             vvar_id_start=self.vvar_id_start,
         )
         self.vvar_id_start = ssailification.max_vvar_id + 1
+        assert ssailification.out_graph is not None
         return ssailification.out_graph
 
     @timethis
@@ -1921,6 +1913,7 @@ class Clinic(Analysis):
                 self._link_variables_on_call(variable_manager, global_variables, block, stmt_idx, stmt, is_expr=False)
 
             elif stmt_type is ailment.Stmt.Return:
+                assert isinstance(stmt, ailment.Stmt.Return)
                 self._link_variables_on_return(variable_manager, global_variables, block, stmt_idx, stmt)
 
     def _link_variables_on_return(
@@ -2252,6 +2245,7 @@ class Clinic(Analysis):
     def _create_triangle_for_ite_expression(self, ail_graph, block_addr: int, ite_ins_addr: int):
         ite_insn_only_block = self.project.factory.block(ite_ins_addr, num_inst=1)
         ite_insn_size = ite_insn_only_block.size
+        assert ite_insn_size is not None
         if ite_insn_size <= 2:  # we need an address for true_block and another address for false_block
             return None
         if ite_insn_only_block.vex.exit_statements:
@@ -3205,7 +3199,7 @@ class Clinic(Analysis):
                         )
                         break
 
-        if alloca_node is not None:
+        if alloca_node is not None and sp_equal_to is not None:
             stmt0 = alloca_node.statements[1]
             statements = [ailment.Stmt.Call(stmt0.idx, "alloca", args=[sp_equal_to], **stmt0.tags)]
             new_node = ailment.Block(alloca_node.addr, alloca_node.original_size, statements=statements)

{angr-9.2.153 → angr-9.2.154}/angr/analyses/decompiler/decompilation_cache.py

@@ -31,7 +31,7 @@ class DecompilationCache:
         self.parameters: dict[str, Any] = {}
         self.addr = addr
         self.type_constraints: dict[TypeVariable, set[TypeConstraint]] | None = None
-        self.func_typevar = None
+        self.func_typevar: TypeVariable | None = None
         self.var_to_typevar: dict | None = None
         self.codegen: BaseStructuredCodeGenerator | None = None
         self.clinic: Clinic | None = None

{angr-9.2.153 → angr-9.2.154}/angr/analyses/decompiler/ssailification/ssailification.py

@@ -107,7 +107,7 @@ class Ssailification(Analysis):  # pylint:disable=abstract-method
         )
         self.secondary_stackvars = rewriter.secondary_stackvars
         self.out_graph = rewriter.out_graph
-        self.max_vvar_id = rewriter.max_vvar_id
+        self.max_vvar_id: int = rewriter.max_vvar_id if rewriter.max_vvar_id is not None else 0
 
     def _calculate_virtual_variables(
         self,