search

arguslab / NativeFlowBench

Benchmark apps for static analyzing native world of Android applications.
12 stars 5 forks source link

native_method_overloading task seems to leak data #2

Open j31d0 opened 3 years ago

j31d0 commented 3 years ago

Hello. I have a question about native_method_overloading task.

https://github.com/arguslab/NativeFlowBench/blob/b92ad62a9a66a24461c043fc248f39a3a3cc1ebb/native_method_overloading/src/main/java/org/arguslab/native_method_overloading/MainActivity.java#L14-L17

These comments asserts there is no leak in this task.

https://github.com/arguslab/NativeFlowBench/blob/b92ad62a9a66a24461c043fc248f39a3a3cc1ebb/native_method_overloading/src/main/java/org/arguslab/native_method_overloading/MainActivity.java#L40-L47

And in leakImei(), it calls send method with 4 arguments (corresponds to signature native void send(int[] array, String[] array2, String data, double d)

https://github.com/arguslab/NativeFlowBench/blob/b92ad62a9a66a24461c043fc248f39a3a3cc1ebb/native_method_overloading/src/main/jni/method_overloading.cpp#L38-L45

But in JNI code, it clearly leaks the data (as comment). Does it actually leaks data? or it's just my misunderstanding?

cjc-github commented 1 year ago

I think so too.

cjc-github commented 1 year ago

I recreated an apk according to this source code, but JNSAF detected a leak.