ChrisTimperley / RepairChain

AIxCC: automated vulnerability repair via LLMs, search, and static analysis
Apache License 2.0
3 stars 0 forks source link

Improve templates for initializing uninitialized memory (includes sanitizer parsing fixes). #73

Closed clegoues closed 1 month ago

clegoues commented 1 month ago

Note that I have already pulled in the changes from https://github.com/ChrisTimperley/RepairChain/pull/72 on this branch, my idea being you can tell me to only merge that one, or accept this one. Those changes should be accepted regardless.

This PR improves initialize memory template strategy to take better advantage of the more detailed information in the sanitizer report.

Thus, the relevant changes are to llm/helper_code.py, and to init_mem.py

Rationale: The original initialize memory template was a bit naive/conservative. It only tried to repair one location --- where the error triggered --- which isn't always even in the implicated function, but rather can be buried several calls deep.

This version instead attempts patches to initialize the uninitialized memory along calls in the allocation stack for the sanitizer report.

I have "tested" it by modifying the sanitizer.txt for nginx to be a fake memsan report --- corresponding to the gpt produced report, but with stack frames referencing nginx locations. It does happily produce potential patches, at least when GPT responds.

I can't test it properly since AFAIK we don't have any memory sanitizer reports for uninitialized memory errors.