Null pointer dereference in Keystone EVM backend when setting KS_OPT_SYNTAX

[fa1c4]

Summary

A fuzzer-derived input can trigger a deterministic crash in Keystone Engine through the public C API when the EVM backend is used.

The reproducer opens a Keystone engine with:

ks_open(KS_ARCH_EVM, 0, &ks);

and then calls:

ks_option(ks, KS_OPT_SYNTAX, value);

For the tested EVM backend, setting KS_OPT_SYNTAX appears to dereference an uninitialized or null architecture-specific syntax-related pointer, causing a SIGSEGV before ks_asm() is reached.

Affected version tested

keystone-engine/keystone commit fb92f32391c6cced868252167509590319eeb58b

The exact affected version range is unknown and should be confirmed by maintainers.

Affected component

Keystone Engine C API
ks_open(KS_ARCH_EVM, ...)
ks_option(..., KS_OPT_SYNTAX, ...)
EVM backend option handling

Reproduction

https://github.com/fa1c4/security-advisories/tree/main/keystone

Build and run:

docker build -t keystone-evm-syntax-null-deref-poc .
docker run --rm keystone-evm-syntax-null-deref-poc
echo "exit=$?"

Observed result

The process crashes immediately after setting the syntax option:

Setting KS_OPT_SYNTAX to 0x78

The reproduced container exits with SIGSEGV / exit code 139.

Expected result

Calling ks_option(ks, KS_OPT_SYNTAX, value) on an architecture that does not support syntax selection should return an error such as KS_ERR_OPT_INVALID, rather than dereferencing a null pointer and terminating the process.