RiS3-Lab / kubo

Use on-demand control- data- flow slicing combined with taint analysis and symbolic execution to produce scalable and precise UB detection for Linux kernel.
23 stars 3 forks source link

Bug fix #7

Closed peng-hui closed 3 years ago

peng-hui commented 3 years ago

For the case below, I find KUBO does not correctly label the user-controlled parameter argp with F_USER. I think the problem exists in pass/Ksym/Oracle.cpp when parsing previously generated UserInputArg. The PR tries to this problem. Please help validate the PR.

int test(int __user *argp) {
    return 10 / *argp;
}

Thanks!