[[email protected]:287] AttributeError: 'NoneType' object has no attribute 'members'

[bugfinder-bot]

What happened?

  File "/opt/dewolf/decompiler/util/bugfinder/bugfinder.py", line 201, in iter_function_reports
    task, code = self.decompile(function, task_options=options)
  File "/opt/dewolf/decompile.py", line 80, in decompile
    result = self.decompile_all([function_id], task_options)
  File "/opt/dewolf/decompile.py", line 64, in decompile_all
    self._frontend.lift(task)
  File "/opt/dewolf/decompiler/frontend/binaryninja/frontend.py", line 83, in lift
    raise e
  File "/opt/dewolf/decompiler/frontend/binaryninja/frontend.py", line 76, in lift
    task.cfg = parser.parse(function)
  File "/opt/dewolf/decompiler/frontend/binaryninja/parser.py", line 49, in parse
    index_to_BasicBlock[basic_block.index] = BasicBlock(basic_block.index, instructions=list(self._lift_instructions(basic_block)))
  File "/opt/dewolf/decompiler/frontend/binaryninja/parser.py", line 148, in _lift_instructions
    if lifted_instruction := self._lifter.lift(instruction):
  File "/opt/dewolf/decompiler/frontend/binaryninja/lifter.py", line 33, in lift
    if pseudo_expression := handler(expression, **kwargs):
  File "/opt/dewolf/decompiler/frontend/binaryninja/handlers/assignments.py", line 134, in lift_store
    self._lifter.lift(assignment.src),
  File "/opt/dewolf/decompiler/frontend/binaryninja/lifter.py", line 33, in lift
    if pseudo_expression := handler(expression, **kwargs):
  File "/opt/dewolf/decompiler/frontend/binaryninja/handlers/constants.py", line 61, in lift_constant_pointer
    res = self._lifter.lift(variable, view=view, parent=pointer)
  File "/opt/dewolf/decompiler/frontend/binaryninja/lifter.py", line 33, in lift
    if pseudo_expression := handler(expression, **kwargs):
  File "/opt/dewolf/decompiler/frontend/binaryninja/handlers/globals.py", line 182, in lift_global_variable
    return self._lift_datavariable_by_type[type(variable.type)](variable, parent, callers=callers)
  File "/opt/dewolf/decompiler/frontend/binaryninja/handlers/globals.py", line 251, in _lift_pointer_type
    self._lifter.lift(self._view.get_data_var_at(variable.value), view=self._view, callers=callers),
  File "/opt/dewolf/decompiler/frontend/binaryninja/lifter.py", line 33, in lift
    if pseudo_expression := handler(expression, **kwargs):
  File "/opt/dewolf/decompiler/frontend/binaryninja/handlers/globals.py", line 182, in lift_global_variable
    return self._lift_datavariable_by_type[type(variable.type)](variable, parent, callers=callers)
  File "/opt/dewolf/decompiler/frontend/binaryninja/handlers/globals.py", line 267, in _lift_named_type_ref
    return self._lift_struct_helper(variable, parent, struct_type)
  File "/opt/dewolf/decompiler/frontend/binaryninja/handlers/globals.py", line 287, in _lift_struct_helper
    for member_type in struct_type.members:

Error class [email protected]:287 contains 265 cases.

How to reproduce?

python decompile.py 588f3edabde316ad7e885884873c93863499bd741f7dcd5009e74a84b6debc6e sub_402710 --debug

sample: 588f3edabde316ad7e885884873c93863499bd741f7dcd5009e74a84b6debc6e
case: https://bugfinder.seclab-bonn.de/case/85847/
dewolf commit: e18c9d3
Binaryninja version: 3.5.4526

[NeoQuix]

BNinja has a concept of type references (NamedTypeReferenceClass), that point to a real type in the binary view.
However, in this case the type pointed at is not existent, thus yielding a NoneType and creating an exception.
The API does allow in the type hints to return a NoneType (Optional).

An example for this exception is the following type:
struct std::basic_istream<char,struct std::char_traits<char> >::vftable'

Without a type, the value and size is unknown, wherefore the lifter can't create our custom type.
Possible upstream issue.