From d6779c42d776050dd1857d10dff989c1ae3b5d0d Mon Sep 17 00:00:00 2001
From: Giovanni <561184+wargio@users.noreply.github.com>
Date: Sun, 25 Jun 2023 13:44:02 +0800
Subject: [PATCH] Add len check in esil code before calling rz_analysis_op
 (#3603)

---
 librz/analysis/op.c    | 2 +-
 librz/core/canalysis.c | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/librz/analysis/op.c b/librz/analysis/op.c
index ce73ece991..d5d5df24e3 100644
--- a/librz/analysis/op.c
+++ b/librz/analysis/op.c
@@ -94,9 +94,9 @@ static int defaultCycles(RzAnalysisOp *op) {
 }
 
 RZ_API int rz_analysis_op(RzAnalysis *analysis, RzAnalysisOp *op, ut64 addr, const ut8 *data, int len, RzAnalysisOpMask mask) {
-	rz_analysis_op_init(op);
 	rz_return_val_if_fail(analysis && op && len > 0, -1);
 
+	rz_analysis_op_init(op);
 	int ret = RZ_MIN(2, len);
 	if (len > 0 && analysis->cur && analysis->cur->op) {
 		// use core binding to set asm.bits correctly based on the addr
diff --git a/librz/core/canalysis.c b/librz/core/canalysis.c
index 0d7a4672b4..ef8dbe0526 100644
--- a/librz/core/canalysis.c
+++ b/librz/core/canalysis.c
@@ -3425,6 +3425,9 @@ RZ_API void rz_core_analysis_esil(RzCore *core, ut64 addr, ut64 size, RZ_NULLABL
 
 		rz_analysis_op_fini(&op);
 		rz_asm_set_pc(core->rasm, cur);
+		if (i >= iend) {
+			goto repeat;
+		}
 		rz_analysis_op(core->analysis, &op, cur, buf + i, iend - i, RZ_ANALYSIS_OP_MASK_ESIL | RZ_ANALYSIS_OP_MASK_VAL | RZ_ANALYSIS_OP_MASK_HINT);
 		// if (op.type & 0x80000000 || op.type == 0) {
 		if (op.type == RZ_ANALYSIS_OP_TYPE_ILL || op.type == RZ_ANALYSIS_OP_TYPE_UNK) {