Avoid memory corruption in arm context save/restore code

[droe]

Addresses multiple issues in the arm context save/restore code:

• When restoring from context, do not clobber pointers in CPUARMState with data from the context buffer. This causes use-after-free bugs usually manifesting as double-free crashes.
• When saving to context, do not copy pointers from CPUARMState to the context buffer, to avoid leaking pointers to the context. Instead, zero the respective area of the context buffer, to ensure that reg_read and reg_write can access fields outside of the copied range. Specifically, env->uc needs to be NULL when accessed for a context.
• When restoring to a CPU with a different nr than the source CPU, copy min(nr, ctx_nr) instead of nothing at all.
• Add regression tests checking all CPU models for arm and arm64 for trivial double-free crashes.

Fixes #2195

[wtdcode]

Is this removed by design?

[droe]

Yes. We no longer clobber env->uc during restore, hence we do not need to fix env->uc to the correct uc after clobbering it with a potentially stale or mismatching pointer from the context.

[wtdcode]

LGTM except Specifically, env->uc needs to be NULL when accessed for a context.. Could you elaborate the reason?

[droe]

The reason is that AArch32 reg_write wants to write to env->uc->thumb when setting pc, and it checks if uc is NULL to check if it is operating on a live uc or a context, see:

unicorn/qemu/target/arm/unicorn_arm.c

Lines 440 to 443 in d4076e1

	if (env->uc) {
	// This can be NULL if env is a context
	env->uc->thumb = (*(uint32_t *)value & 1);
	}

reg_write writing to uc->thumb looks like a potential bug to me, but I did not want to investigate and touch that in this PR. Maybe this PR should address that too, what do you think?

[wtdcode]

The reason is that AArch32 reg_write wants to write to env->uc->thumb when setting pc, and it checks if uc is NULL to check if it is operating on a live uc or a context, see:

unicorn/qemu/target/arm/unicorn_arm.c

Lines 440 to 443 in d4076e1

	if (env->uc) {
	// This can be NULL if env is a context
	env->uc->thumb = (*(uint32_t *)value & 1);
	}

reg_write writing to uc->thumb looks like a potential bug to me, but I did not want to investigate and touch that in this PR. Maybe this PR should address that too, what do you think?

This points to a903fa1

Would you mind rebasing your branch to the latest dev so that we can have CI to run?

[droe]

Rebased on latest dev.

[wtdcode]

mingw test failure is Github Action bug.

[droe]

This points to a903fa1

I am not sure why thumb is a property of uc and not part of the CPU state, but thinking about it some more, the behaviour makes sense. I think this PR can go in as is (unless there are any concerns of course).

[droe]

Rebased on top of latest dev and resolved merge conflict.