Skip to content

Stack bounds check is off by one #754

@Alan-Jowett

Description

@Alan-Jowett

Two test cases, one passes, one fails.

Passing

---
test-case: Read uninitialized stack range - aligned

pre:
  - r10.type=stack
  - r10.stack_offset=512

code:
  <start>: |
    r0 = *(u64 *)(r10 - 8)

post:
  - "r0.ctx_offset=s[504...511].ctx_offset"
  - "r0.map_fd=s[504...511].map_fd"
  - "r0.packet_offset=s[504...511].packet_offset"
  - "r0.shared_offset=s[504...511].shared_offset"
  - "r0.shared_region_size=s[504...511].shared_region_size"
  - "r0.stack_numeric_size=s[504...511].stack_numeric_size"
  - "r0.stack_offset=s[504...511].stack_offset"
  - "r0.svalue=s[504...511].svalue"
  - "r0.type=s[504...511].type"
  - "r0.uvalue=s[504...511].uvalue" 
  - "r10.stack_offset=512"
  - "r10.type=stack"

messages:
  - "0: Stack content is not numeric (valid_access(r10.offset-8, width=8) for read)"

Failing with "Unseen messages: 0: Stack content is not numeric (valid_access(r10.offset-10, width=8) for read)"

test-case: Read uninitialized stack range - unaligned

pre:
  - r10.type=stack
  - r10.stack_offset=512

code:
  <start>: |
    r0 = *(u64 *)(r10 - 10)

post:
  - "r0.ctx_offset=s[502...509].ctx_offset"
  - "r0.map_fd=s[502...509].map_fd"
  - "r0.packet_offset=s[502...509].packet_offset"
  - "r0.shared_offset=s[502...509].shared_offset"
  - "r0.shared_region_size=s[502...509].shared_region_size"
  - "r0.stack_numeric_size=s[502...509].stack_numeric_size"
  - "r0.stack_offset=s[502...509].stack_offset"
  - "r0.svalue=s[502...509].svalue"
  - "r0.type=s[502...509].type"
  - "r0.uvalue=s[502...509].uvalue" 
  - "r10.stack_offset=512"
  - "r10.type=stack"

messages:
  - "0: Stack content is not numeric (valid_access(r10.offset-10, width=8) for read)"

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions