search

PLSysSec / sys

Sys: A Static/Symbolic Tool for Finding Good Bugs in Good (Browser) Code
https://cseweb.ucsd.edu/~dstefan/pubs/brown:2020:sys.pdf
GNU General Public License v2.0
215 stars 41 forks source link

32bit taint checker #14

Closed chadbrewbaker closed 3 years ago

chadbrewbaker commented 3 years ago

Tell me if I am insane or if this has a chance at detecting CVE-2020-15999 style bugs.

Writing a static checker that marks 16 bit magnitude allocated mallocs and warns when they get 32 bit magnitude accesses?

deian commented 3 years ago

Looking forward to it!

chadbrewbaker commented 3 years ago

Ok, I'll take a stab at it. IMHO void malloc (size_t size); is bad mojo. Programmers should be explicit with void malloc(uint16/32/64_t size); so accessors can be at least byte magnitude typed. Need to noodle on whole program LLVM for freetype to bring in the LLVM IR for libpng - also cut code not in that call path to make a corpus to test on.