{"record":{"id":"f5a8f85cd57a27c8","repo":"NationalSecurityAgency/ghidra","slug":"code-unit-would-extend-beyond-address-space","errorCode":null,"errorMessage":"Code unit would extend beyond address space","messagePattern":"Code unit would extend beyond address space","errorType":"exception","errorClass":"CodeUnitInsertionException","httpStatus":null,"severity":"error","filePath":"Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/database/listing/DBTraceInstructionsView.java","lineNumber":413,"sourceCode":"\t\t// TODO: Ensure cached undefineds don't extend into defined stuff\n\t\t// TODO: Explicitly remove undefined from cache, or let weak refs take care of it?\n\t\treturn created;\n\t}\n\n\t@Override\n\tpublic DBTraceInstruction create(Lifespan lifespan, Address address, TracePlatform platform,\n\t\t\tInstructionPrototype prototype, ProcessorContextView context, int forcedLengthOverride)\n\t\t\tthrows CodeUnitInsertionException {\n\t\tInternalTracePlatform dbPlatform = space.manager.platformManager.assertMine(platform);\n\t\ttry (LockHold hold = LockHold.lock(space.lock.writeLock())) {\n\t\t\tDBTraceInstruction created =\n\t\t\t\tdoCreate(lifespan, address, dbPlatform, prototype, context, forcedLengthOverride);\n\t\t\tspace.trace.setChanged(\n\t\t\t\tnew TraceChangeRecord<>(TraceEvents.CODE_ADDED, space.space, created, created));\n\t\t\treturn created;\n\t\t}\n\t\tcatch (AddressOverflowException e) {\n\t\t\tthrow new CodeUnitInsertionException(\"Code unit would extend beyond address space\");\n\t\t}\n\t}\n\n\t/**\n\t * Prepare to check a block for conflicts\n\t * \n\t * @param startSnap the minimum snap for each instruction\n\t * @param block the block of instructions\n\t * @return an iterator for overlapping object pairs\n\t */\n\tprotected OverlappingObjectIterator<Instruction, CodeUnit> startCheckingBlock(long startSnap,\n\t\t\tInstructionBlock block) {\n\t\tAddress startAddress = block.getStartAddress();\n\t\tCodeUnit found = space.definedUnits.getContaining(startSnap, startAddress);\n\t\tif (found != null) {\n\t\t\tstartAddress = found.getAddress();\n\t\t}\n\t\tIterator<Instruction> instructions = block.iterator();","sourceCodeStart":395,"sourceCodeEnd":431,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/trace/database/listing/DBTraceInstructionsView.java#L395-L431","documentation":"Thrown by DBTraceInstructionsView.create() when doCreate() throws an AddressOverflowException, which occurs when address.addNoWrap(length - 1) overflows the address space. The create() method catches the AddressOverflowException and re-throws it as a CodeUnitInsertionException with this message. This means the instruction's end address (address + length - 1) would exceed the maximum address of the address space.","triggerScenarios":"Calling create() with an address near the top of the address space and a non-zero instruction length such that address + length - 1 wraps or exceeds the address space boundary. For example, creating a 4-byte instruction at 0xFFFFFFFC in a 32-bit space (which is valid), but at 0xFFFFFFFE it would overflow.","commonSituations":"Disassembling the last bytes of a memory region near the address space boundary. Creating instructions with length overrides that push the end address beyond the space limit. Processing corrupted or malformed instruction data that yields unexpectedly large lengths.","solutions":["Check that address.addNoWrap(length - 1) does not throw AddressOverflowException before calling create().","Validate the address has enough room: addr.getOffset() + length - 1 <= addr.getAddressSpace().getMaxAddress().getOffset().","Use a shorter length or an earlier start address.","Catch CodeUnitInsertionException and check for this condition when it occurs near the address space boundary."],"exampleFix":"// before\nDBTraceInstruction instr = view.create(lifespan, addr, platform, proto, ctx, length);\n\n// after\ntry {\n    addr.addNoWrap(length - 1); // pre-check\n} catch (AddressOverflowException e) {\n    // adjust length or skip\n    return;\n}\nDBTraceInstruction instr = view.create(lifespan, addr, platform, proto, ctx, length);","handlingStrategy":"validation","validationCode":"// Pre-check address space bounds\ntry {\n    address.addNoWrap(length - 1);\n} catch (AddressOverflowException e) {\n    // would overflow; reduce length or skip\n    length = (int)(address.getAddressSpace().getMaxAddress().getOffset() - address.getOffset() + 1);\n    if (length <= 0) return; // no room at all\n}","typeGuard":null,"tryCatchPattern":"try {\n    DBTraceInstruction instr = view.create(lifespan, addr, platform, proto, ctx, len);\n} catch (CodeUnitInsertionException e) {\n    if (e.getMessage().contains(\"beyond address space\")) {\n        // instruction too close to space boundary; reduce length or skip\n    }\n}","preventionTips":["Check address + length - 1 does not exceed the address space max before creating.","Be especially careful when disassembling the last bytes of a memory region.","Validate instruction lengths from untrusted or malformed data."],"tags":["instruction","trace-database","address-overflow","checked-exception","bounds"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}