PLSysSec / sys

Sys: A Static/Symbolic Tool for Finding Good Bugs in Good (Browser) Code
https://cseweb.ucsd.edu/~dstefan/pubs/brown:2020:sys.pdf
GNU General Public License v2.0
215 stars 41 forks source link

bad detect heapoob bug #13

Closed maldiohead closed 3 years ago

maldiohead commented 3 years ago

hello, I use the follow code to test the ability of heapoob ,but it is not detected

int main() { int a; char* ptr=malloc(1000); ptr[2000]=0xa; int b=a+10; return b; }

deian commented 3 years ago

The checker we implemented (and describe in the paper) won't catch these kinds of heap oob bugs, unfortunately. You'd have to either modify the checker. (If you do, please just name it something else we'd be happy to merge it in!)