Module Identification sigsev

[Patrick-apl]

Describe the bug
When running the module identification plugin I am getting a SIGSEV error that crashes HAL.

To Reproduce
Something to do with module identification I do not have a sharable design that I know causes the issue.

Expected behavior
The calculations

Desktop (please complete the following information):
Ubuntu 24.04

Additional context
From module identification we call create_candidates for the functional candidates.
https://github.com/emsec/hal/blob/master/plugins/module_identification/src/api/module_identification.cpp#L169

auto new_candidates_res         = FunctionalCandidate::create_candidates(sc, config.m_max_control_signals, sc->ctx, type, config.m_known_registers);

From there my specific type was constant_multiplication_offset (not sure if this is part of the problem).

Then we are calling create_input_extenson_variants. From there we are trying to perform apply_extension.
https://github.com/emsec/hal/blob/master/plugins/module_identification/src/processing/create_functional_candidates.cpp#L1775

new_candidate.m_operands.at(op_idx) = apply_extension(new_candidate.m_operands.at(op_idx), out_size, ex_s.at(op_idx), sign_net);

If the extension type is 2 "sign extended up until the second highest bit" and the size is 1, then the first extend will create an op vector of size 0 then the second will try to access index 0 and cause a crash.

case 2:
// sign extended up until the second highest bit
new_op = sign_extend_operand(new_op, size - 1, sign_net);
new_op = zero_extend_operand(new_op, size);

I am not sure why the size is 1, if that is the real problem and this is just a symptom.

[SimonKlx]

Hello, sorry for the late reply.
I tried to push a fix for this in this commit: 9900bf1f8ebe946eef148c24d1953e135caf27e0.
But without a minimal example i of course cannot guarantee that this is solving your problem or there will be more problems down the line.
However i would assume that something unexpected is happening earlier in the process, as operands consisting of only one bit/net seem unintended.

[Patrick-apl]

Yeah I would agree the problem seems likely to be further down the chain but I am unsure how to determine why the tool thought a one bit net was worth analyzing. I'll try to get the commit tested in the next couple of days to see if it fixes my problem.