Closed StarGazerM closed 2 years ago
Hi Yihao, I think you might be right. In this case, we should restrict the rule to only positive offsets. I'll make a fix.
This is not the only every places, every conversion from sign to unsigned number can cause overflow, if possible could you kindly check all datalog code base for pattern as\(.+,address\)
. I searched on repo there are a lot of possible overflow places. Thanks!
Hi: When I am reading souffle code in src/datalog/value_analysis.dl.
I found in line 123, a variable has type
number
is casted toaddress(unsigned)
. ddisasm require enable 64bit domain when compiling souffle, so this casting will always make Offset_addr become a u64 address even when handling 32bit binary. For example,-1
will be converted into18446744073709551615
, while in 32bit mode it should be4294967295
.Yihao