loader: handle SegmentationViolation for malformed ELF files #2799

kami922 · 2025-12-23T16:05:59Z

When processing malformed ELF files with invalid relocations, vivisect raises envi.exc.SegmentationViolation during relocation processing. This change catches these exceptions and converts them to CorruptFile exceptions with helpful error messages instead of crashing with a traceback.

Summary

When processing malformed ELF files with invalid relocations, vivisect raises envi.exc.SegmentationViolation during relocation processing. This PR catches these exceptions and converts them to CorruptFile exceptions with helpful error messages instead of crashing with a traceback.

Changes

Added exception handling for envi.exc.SegmentationViolation in get_workspace()
Converts low-level vivisect errors to user-friendly CorruptFile exception
Updated CHANGELOG.md

gemini-code-assist · 2025-12-23T16:06:12Z

Summary of Changes

Hello @kami922, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the loader's resilience by introducing specific exception handling for vivisect's SegmentationViolation errors. This change ensures that when processing malformed ELF files, the application gracefully handles invalid memory references, providing clear CorruptFile exceptions instead of crashing, thereby improving the overall stability and user experience.

Highlights

Robust Error Handling: Implemented robust error handling for malformed ELF files that cause envi.exc.SegmentationViolation during relocation processing.
User-Friendly Exceptions: Converted low-level vivisect SegmentationViolation exceptions into more user-friendly CorruptFile exceptions with informative error messages, preventing application crashes.
Changelog Update: Updated the CHANGELOG.md to reflect the fix for gracefully handling malformed ELF files.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request effectively addresses a crash when processing malformed ELF files by introducing specific exception handling for envi.exc.SegmentationViolation. The change correctly catches this low-level error and raises a more user-friendly CorruptFile exception, improving the tool's robustness and error reporting. The implementation is clean, follows best practices by chaining exceptions, and includes a corresponding update to the changelog. This is a great improvement.

mike-hunhoff

Thank you @kami922. Please see my review and address the requested changes.

CHANGELOG.md

capa/loader.py

@mike-hunhoff

- Move import envi.exc to align with viv_utils lazy imports - Update CHANGELOG to reference PR mandiant#2799 instead of issue mandiant#2794 Addresses feedback from @mike-hunhoff

mike-hunhoff

Thanks @kami922 , one last change for your review.

mike-hunhoff · 2026-01-06T16:47:32Z

CHANGELOG.md


 ### Bug Fixes

+- loader: gracefully handle malformed ELF files with invalid relocations kamranulhaq2002@gmail.com #2799


Please move this to the unreleased section of the CHANGELOG, see

capa/CHANGELOG.md

Line 3 in dc47de1

## master (unreleased)

@kami922 bump

@kami922 this needs to be removed.

@kami922 this still needs to be removed.

mike-hunhoff · 2026-01-06T16:48:33Z

Also, @kami922 please sync with the master branch.

Catch envi.exc.SegmentationViolation raised by vivisect when parsing malformed ELF files with invalid relocations and convert to a user-friendly CorruptFile error message. Follows existing error handling pattern in get_workspace(). Refs mandiant#2799

kami922 · 2026-01-12T18:09:52Z

@mike-hunhoff i had accidently pushed 2nd last commit to wrong branch please check and lemme know

- Remove old duplicate CHANGELOG entry that was in the wrong version section - Keep only the correct entry in master (unreleased) section with PR mandiant#2799 - Ensure import envi.exc is in lazy import section, not at top level - All pre-commit checks (isort, black, ruff) pass

mike-hunhoff · 2026-01-16T15:45:21Z

CHANGELOG.md

+- anti-analysis/anti-av/patch-bitdefender-hooking-dll-function jakubjo- nursery/acquire-load-driver-privileges mehunhoff@google.com
+nhoff@google.com


@kami922 please revert

mike-hunhoff · 2026-01-16T16:37:43Z

CHANGELOG.md

@kami922 please revert all changes to this file other than the new entry needed for your PR.

@kami922 bump

- CHANGELOG.md: kept both PR mandiant#2800, mandiant#2799, and mandiant#2802 entries - tests/fixtures.py: resolved duplicate and formatting conflicts - .github/workflows/tests.yml: resolved formatting conflict - tests/data: accepted submodule deletion

kami922 · 2026-01-17T21:03:16Z

@mike-hunhoff can I please get an update on my PRs I will then shift to CI workflow issue after at least 1 is merged to avoid confusion in future

mr-tz · 2026-01-19T19:59:54Z

see the comment regarding the changelog, is there also a test file and test you could add for this?

Catch envi.exc.SegmentationViolation raised by vivisect when parsing malformed ELF files with invalid relocations and convert to a user-friendly CorruptFile error message. Follows existing error handling pattern in get_workspace(). Refs mandiant#2799

Catch envi.exc.SegmentationViolation raised by vivisect when processing malformed ELF files with invalid relocations and convert it to a CorruptFile exception with a descriptive message. Closes mandiant#2794

gemini-code-assist bot reviewed Dec 23, 2025

View reviewed changes

mike-hunhoff requested changes Dec 29, 2025

View reviewed changes

CHANGELOG.md Outdated Show resolved Hide resolved

capa/loader.py Outdated Show resolved Hide resolved

capa/loader.py Outdated Show resolved Hide resolved

kami922 force-pushed the fix-2794-segfault branch from 546a672 to 7133762 Compare December 29, 2025 21:25

kami922 requested a review from mike-hunhoff January 2, 2026 14:44

mike-hunhoff requested changes Jan 6, 2026

View reviewed changes

mike-hunhoff reviewed Jan 16, 2026

View reviewed changes

mike-hunhoff added this to the v10 milestone Jan 16, 2026

kami922 added a commit to kami922/capa that referenced this pull request Jan 16, 2026

changelog: add entry for PR mandiant#2799 only

00d6211

kami922 force-pushed the fix-2794-segfault branch from 4711f8b to 64efebb Compare January 26, 2026 13:49

loader: handle SegmentationViolation for malformed ELF files

c0dd562

Catch envi.exc.SegmentationViolation raised by vivisect when processing malformed ELF files with invalid relocations and convert it to a CorruptFile exception with a descriptive message. Closes mandiant#2794

kami922 force-pushed the fix-2794-segfault branch from 64efebb to c0dd562 Compare January 26, 2026 13:50


		### Bug Fixes

		- loader: gracefully handle malformed ELF files with invalid relocations kamranulhaq2002@gmail.com #2799

		- anti-analysis/anti-av/patch-bitdefender-hooking-dll-function jakubjo- nursery/acquire-load-driver-privileges mehunhoff@google.com
		nhoff@google.com

loader: handle SegmentationViolation for malformed ELF files #2799

Are you sure you want to change the base?

loader: handle SegmentationViolation for malformed ELF files #2799

Conversation

kami922 commented Dec 23, 2025

Summary

Changes

Uh oh!

gemini-code-assist bot commented Dec 23, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

mike-hunhoff left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mike-hunhoff left a comment

Choose a reason for hiding this comment

Uh oh!

mike-hunhoff Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

mike-hunhoff Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

mike-hunhoff Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

mike-hunhoff Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

mike-hunhoff commented Jan 6, 2026

Uh oh!

kami922 commented Jan 12, 2026

Uh oh!

mike-hunhoff Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

mike-hunhoff Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

mike-hunhoff Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

kami922 commented Jan 17, 2026

Uh oh!

mr-tz commented Jan 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants