Crash within Thumb2Architecture::populateDecomposeRequest when lifting IT-family instruction

[sentry]

Sentry Issue: BINARYNINJA-89

EXCEPTION_ACCESS_VIOLATION_READ / 0x2ba87291000: Fatal Error: EXCEPTION_ACCESS_VIOLATION_READ / 0x2ba87291000
  File "arch_thumb2.cpp", line 107, in Thumb2Architecture::populateDecomposeRequest
  File "arch_thumb2.cpp", line 1686, in Thumb2Architecture::GetInstructionLowLevelIL
  File "architecture.cpp", line 779, in BinaryNinja::Architecture::GetInstructionLowLevelILCallback
  File "defaultarch.cpp", line 812, in BinaryNinja::Architecture::DefaultLiftFunction
  File "architecture.cpp", line 799, in BinaryNinja::Architecture::LiftFunctionCallback
...
(23 additional frame(s) were not displayed)

@bdash says:

This appears to happen when an IT-family instruction claims there are more instructions following than are actually present in the bytes available to lift.

[bdash]

This reproduces under ASan using:

def test_thumb2_it_block_at_function_end():
    arch = Architecture['thumb2']
    nop = arch.assemble('nop')
    it = arch.assemble('itttt eq')  # IT block whose mask claims 4 instructions
    # A single basic block, exactly 0x3000 bytes, whose last instruction is the
    # IT block. The leading nops are padding to make it easier to trigger a fault
    # under Guard Malloc or ASan.
    code = nop * ((0x3000 - len(it)) // len(nop)) + it
    bv = load(code, options={'loader.platform': 'linux-thumb2'}, update_analysis=False)
    try:
        bv.add_function(0)
        bv.update_analysis_and_wait()
        func = bv.get_function_at(0)
        assert func is not None
        # Force lifting of the IT block, which triggers the out-of-bounds read.
        list(func.low_level_il.instructions)
    finally:
        bv.file.close()

[zznop]

Fixed in 5.4.9671-dev