Skip to content

fix: crash in UiMessageCapture on ARM64 macOS#20

Merged
0xeb merged 1 commit intomainfrom
fix/arm64-va_list-crash
Mar 6, 2026
Merged

fix: crash in UiMessageCapture on ARM64 macOS#20
0xeb merged 1 commit intomainfrom
fix/arm64-va_list-crash

Conversation

@0xeb
Copy link
Member

@0xeb 0xeb commented Mar 6, 2026

Summary

  • SELECT get_ui_context_json() crashes IDA on Apple Silicon with a SIGSEGV in strlen called from vsprnt
  • Root cause: va_list ABI mismatch in UiMessageCapture::on_event() — the code assumed all non-MSVC platforms use array-type va_list (which decays to a pointer in variadic calls), but on ARM64 macOS va_list is char* (scalar, passed by value)
  • Dereferencing the wrong type caused string content ("__IDASQL...") to be used as a pointer → SIGSEGV
  • Fix: guard the pointer-indirection path with __x86_64__ (the only platform with array-type va_list) instead of !_MSC_VER

Test plan

  • Rebuild plugin on ARM64 macOS, load in IDA, run SELECT get_ui_context_json() — should return JSON instead of crashing
  • Verify x86-64 macOS/Linux builds still work (no behavior change on those platforms)
  • Verify MSVC build still works (no change to that code path)

On ARM64 macOS, va_list is char* (scalar), not an array type like on
x86-64 System V ABI (__va_list_tag[1]). The old #ifdef only special-cased
MSVC, so on ARM64 Apple the code read va_list* (expecting array decay)
but got a char* value — dereferencing it used string content as a pointer,
causing a SIGSEGV in strlen via vsprnt.

Fix: guard the pointer-indirection path with __x86_64__ instead of !_MSC_VER.
@0xeb 0xeb merged commit 30849f1 into main Mar 6, 2026
8 checks passed
@0xeb 0xeb deleted the fix/arm64-va_list-crash branch March 6, 2026 15:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant