angr / tracer

Utilities for generating dynamic traces
BSD 2-Clause "Simplified" License
88 stars 28 forks source link

scanf not handling newlines correctly #49

Closed mdehavensift closed 2 years ago

mdehavensift commented 6 years ago

This issue might be more appropriately put in the angr issues. I'm not sure.

When newlines are encountered in stdin, the scanf simprocedure does not handle them correctly.

Here's an example program

scan_loop.c

#include <stdio.h>

int main() {
  char value[2];
  int i;
  for (i = 0; i < 3; i++) {
    scanf("%2s", &value);
    printf("%s\n", value);
  }
}

With the following input, tracer does not produce the same value for stdout as the actual program.

problem_input.txt

a
b
c

The output of the actual program:

> ./scan_loop < problem_input.txt
a
b
c

Running the following code does not produce the same output:

import tracer
program_input = open("problem_input.txt", "r").read()
t = tracer.Tracer("scan_loop", program_input)
result, _ = t.run()
print result.posix.dumps(1)

Running the above code shows that the value of stdout that tracer has is "a\n\n\n". It seems to stop reading stdin correctly after it encounters the first new line.

If the newlines are replaced with a different character, it continues to work as expected.

working_input.txt

a?b?c?
import tracer
program_input = open("working_input.txt", "r").read()
t = tracer.Tracer("scan_loop", program_input)
result, _ = t.run()
print result.posix.dumps(1)

In this case, the output is "a?\nb?\nc?\n", which matches the output of the actual program.

So the problem seems to be with the newline character. Once a newline character is encountered in scanf, further calls to scanf do not work correctly.

github-actions[bot] commented 2 years ago

This issue has been marked as stale because it has no recent activity. Please comment or add the pinned tag to prevent this issue from being closed.

github-actions[bot] commented 2 years ago

This issue has been closed due to inactivity.