Unary negation (~) operator appears to be broken in the assembler expression calculator

[sam-xif]

Summary of the problem

Hello manticore community,

I am working as part of a research team developing a code analysis tool for Python. One of the issues the tool discovered in manticore's codebase is that the unary negation (~) operator appears to be broken. Whenever even a simple expression, such as ~0x30, is entered, the parser exits with an unhandled error. See below for stack trace.

If you are interested in learning more about the tool and how it found this issue, let me know down in the comments, or you can contact me at [email protected]. We are primarily curious about whether you find that this issue is legitimate and worth reporting and fixing. If not, we would be interested in understanding why.

Thank you for your consideration!

-Sam

Manticore version

Latest master (commit hash: 8861005)

Python version

Python 3.8

OS / Environment

Linux (kernel version 5.10.218)

Dependencies

N/A

Step to reproduce the behavior

Enter an expression that uses the unary negation operator, such as ~0x30 or ~3 & 4.

Expected behavior

The unary negation operator works as expected

Actual behavior

Traceback example:

sxifaras@login-4:/data1/groups/neu-type-fuzzing/data/repos/manticore$ python -m manticore.core.parser.parser
calc > 3 & 4
0
calc > ~3 & 4
Traceback (most recent call last):
  File "/state/partition1/llgrid/pkg/anaconda/anaconda3-2021b/lib/python3.8/runpy.py", line 194, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/state/partition1/llgrid/pkg/anaconda/anaconda3-2021b/lib/python3.8/runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "/data1/groups/neu-type-fuzzing/data/repos/manticore/manticore/core/parser/parser.py", line 355, in <module>
    result = parse(s)
  File "/data1/groups/neu-type-fuzzing/data/repos/manticore/manticore/core/parser/parser.py", line 339, in parse
    result = parser.parse(expression, tracking=True)
  File "/data1/groups/neu-type-fuzzing/data/packages/manticore/ply/yacc.py", line 331, in parse
    return self.parseopt(input, lexer, debug, tracking, tokenfunc)
  File "/data1/groups/neu-type-fuzzing/data/packages/manticore/ply/yacc.py", line 823, in parseopt
    p.callable(pslice)
  File "/data1/groups/neu-type-fuzzing/data/repos/manticore/manticore/core/parser/parser.py", line 206, in p_expression_neg
    p[0] = ~p[1]
TypeError: bad operand type for unary ~: 'str'