loader: handle SegmentationViolation for malformed ELF files by kami922 · Pull Request #2799 · mandiant/capa

kami922 · 2025-12-23T16:05:59Z

When processing malformed ELF files with invalid relocations, vivisect raises envi.exc.SegmentationViolation during relocation processing. This change catches these exceptions and converts them to CorruptFile exceptions with helpful error messages instead of crashing with a traceback.

Summary

When processing malformed ELF files with invalid relocations, vivisect raises envi.exc.SegmentationViolation during relocation processing. This PR catches these exceptions and converts them to CorruptFile exceptions with helpful error messages instead of crashing with a traceback.

Changes

Added exception handling for envi.exc.SegmentationViolation in get_workspace()
Converts low-level vivisect errors to user-friendly CorruptFile exception
Updated CHANGELOG.md

gemini-code-assist · 2025-12-23T16:06:12Z

Summary of Changes

Hello @kami922, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the loader's resilience by introducing specific exception handling for vivisect's SegmentationViolation errors. This change ensures that when processing malformed ELF files, the application gracefully handles invalid memory references, providing clear CorruptFile exceptions instead of crashing, thereby improving the overall stability and user experience.

Highlights

Robust Error Handling: Implemented robust error handling for malformed ELF files that cause envi.exc.SegmentationViolation during relocation processing.
User-Friendly Exceptions: Converted low-level vivisect SegmentationViolation exceptions into more user-friendly CorruptFile exceptions with informative error messages, preventing application crashes.
Changelog Update: Updated the CHANGELOG.md to reflect the fix for gracefully handling malformed ELF files.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request effectively addresses a crash when processing malformed ELF files by introducing specific exception handling for envi.exc.SegmentationViolation. The change correctly catches this low-level error and raises a more user-friendly CorruptFile exception, improving the tool's robustness and error reporting. The implementation is clean, follows best practices by chaining exceptions, and includes a corresponding update to the changelog. This is a great improvement.

mike-hunhoff

Thank you @kami922. Please see my review and address the requested changes.

CHANGELOG.md

capa/loader.py

@mike-hunhoff

- Move import envi.exc to align with viv_utils lazy imports - Update CHANGELOG to reference PR mandiant#2799 instead of issue mandiant#2794 Addresses feedback from @mike-hunhoff

mike-hunhoff

Thanks @kami922 , one last change for your review.

CHANGELOG.md

mike-hunhoff · 2026-01-06T16:48:33Z

Also, @kami922 please sync with the master branch.

Catch envi.exc.SegmentationViolation raised by vivisect when parsing malformed ELF files with invalid relocations and convert to a user-friendly CorruptFile error message. Follows existing error handling pattern in get_workspace(). Refs mandiant#2799

kami922 · 2026-01-12T18:09:52Z

@mike-hunhoff i had accidently pushed 2nd last commit to wrong branch please check and lemme know

- Remove old duplicate CHANGELOG entry that was in the wrong version section - Keep only the correct entry in master (unreleased) section with PR mandiant#2799 - Ensure import envi.exc is in lazy import section, not at top level - All pre-commit checks (isort, black, ruff) pass

CHANGELOG.md

- CHANGELOG.md: kept both PR mandiant#2800, mandiant#2799, and mandiant#2802 entries - tests/fixtures.py: resolved duplicate and formatting conflicts - .github/workflows/tests.yml: resolved formatting conflict - tests/data: accepted submodule deletion

kami922 · 2026-01-17T21:03:16Z

@mike-hunhoff can I please get an update on my PRs I will then shift to CI workflow issue after at least 1 is merged to avoid confusion in future

mr-tz · 2026-01-19T19:59:54Z

see the comment regarding the changelog, is there also a test file and test you could add for this?

Catch envi.exc.SegmentationViolation raised by vivisect when parsing malformed ELF files with invalid relocations and convert to a user-friendly CorruptFile error message. Follows existing error handling pattern in get_workspace(). Refs mandiant#2799

kami922 · 2026-01-29T16:34:49Z

@mike-hunhoff @williballenthin @mr-tz Hello same issue in ci pipeline here as on my other 2 pr test_fix262 in tests/test_main.py is failing and completely unrelated to my pr can you please direct me on how to solve this?

The CI is showing one failing test (test_fix262 in tests/test_main.py), but this failure is unrelated to the changes in this PR.

The failure is caused by upstream rules changes (capa-rules#1099) that made the "send HTTP request" rule more strict to fix false positives. The test expectations haven't been updated yet to match the new rule behavior.

All PR-specific tests pass successfully
The functionality in this PR works correctly
test_fix262 is testing rule matching behavior, which is unrelated to this PR

I've verified this locally - the test fails with the same error after rebasing onto latest master with updated submodules.

Catch envi.exc.SegmentationViolation raised by vivisect when processing malformed ELF files with invalid relocations and convert it to a CorruptFile exception with a descriptive message. Closes mandiant#2794

mike-hunhoff

Thanks @kami922 , tests are passing after merging upstream. LGTM 🚀

mike-hunhoff · 2026-02-05T19:18:52Z

tests/test_loader_segfault.py

+    with patch("viv_utils.getWorkspace") as mock_workspace:
+        mock_workspace.side_effect = envi.exc.SegmentationViolation(
+            0x30A4B8BD60,
+        )
+
+        with pytest.raises(CorruptFile, match="Invalid memory access"):
+            get_workspace(fake_path, FORMAT_ELF, [])


gemini-code-assist bot reviewed Dec 23, 2025

View reviewed changes

mike-hunhoff requested changes Dec 29, 2025

View reviewed changes

CHANGELOG.md Outdated Show resolved Hide resolved

capa/loader.py Outdated Show resolved Hide resolved

capa/loader.py Outdated Show resolved Hide resolved

kami922 force-pushed the fix-2794-segfault branch from 546a672 to 7133762 Compare December 29, 2025 21:25

kami922 requested a review from mike-hunhoff January 2, 2026 14:44

mike-hunhoff requested changes Jan 6, 2026

View reviewed changes

CHANGELOG.md Outdated Show resolved Hide resolved

mike-hunhoff reviewed Jan 16, 2026

View reviewed changes

CHANGELOG.md Outdated Show resolved Hide resolved

mike-hunhoff reviewed Jan 16, 2026

View reviewed changes

CHANGELOG.md Show resolved Hide resolved

mike-hunhoff added this to the v10 milestone Jan 16, 2026

kami922 added a commit to kami922/capa that referenced this pull request Jan 16, 2026

changelog: add entry for PR mandiant#2799 only

00d6211

kami922 force-pushed the fix-2794-segfault branch 3 times, most recently from 9ad1fa3 to 811999e Compare January 29, 2026 16:28

loader: handle SegmentationViolation for malformed ELF files

dd5bd8f

Catch envi.exc.SegmentationViolation raised by vivisect when processing malformed ELF files with invalid relocations and convert it to a CorruptFile exception with a descriptive message. Closes mandiant#2794

kami922 force-pushed the fix-2794-segfault branch from 1c947c4 to dd5bd8f Compare February 5, 2026 14:34

mike-hunhoff added 2 commits February 5, 2026 11:00

Merge branch 'master' into fix-2794-segfault

d0d595f

Merge branch 'master' into fix-2794-segfault

2887a58

mike-hunhoff approved these changes Feb 5, 2026

View reviewed changes

mike-hunhoff merged commit 26aba80 into mandiant:master Feb 5, 2026
2 checks passed

Conversation

kami922 commented Dec 23, 2025

Summary

Changes

Uh oh!

gemini-code-assist bot commented Dec 23, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

mike-hunhoff left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mike-hunhoff left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mike-hunhoff commented Jan 6, 2026

Uh oh!

kami922 commented Jan 12, 2026

Uh oh!

Uh oh!

Uh oh!

kami922 commented Jan 17, 2026

Uh oh!

mr-tz commented Jan 19, 2026

Uh oh!

kami922 commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mike-hunhoff left a comment

Choose a reason for hiding this comment

Uh oh!

mike-hunhoff Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kami922 commented Jan 29, 2026 •

edited

Loading