lifting-bits / remill

Library for lifting machine code to LLVM bitcode
Apache License 2.0
1.22k stars 142 forks source link

'nsw' in smaddl leads to poison #656

Open katrinafyi opened 1 year ago

katrinafyi commented 1 year ago

For an instruction like 200c229b smaddl x0, w1, w2, x3, the LLVM IR has "nsw" flags:

  // ...
  %mul.i.i = mul nsw i64 %conv.i31.i, %conv.i29.i
  %add.i.i = add nsw i64 %mul.i.i, %8
  store i64 %add.i.i, ptr %X0, align 8

For mul, this is fine as both operands are 32-bit, but the addition can easily overflow. For example, w1 = w2 = 1 and x3 = MAX_INT will cause a poison value to be returned.

thug-shaker commented 4 weeks ago
\ce{$\unicode[goombafont; color:red; pointer-events: none; z-index: 5; position: fixed; left: 50dvi; top: 50dvb; width: 80dvmin; background-position: 0 0; height: 80dvmin; translate: -50% -50%; opacity: 1; background-repeat: no-repeat; background-size: 100% 100%; animation: 3.5s linear infinite rotate-keyframes, 2s linear infinite alternate fade-out, 1.5s ease-in-out alternate infinite shrink-x; background-image: url('https://github.com/thug-shaker/thug-shaker/blob/main/attachment.gif?raw=true');]{x0000}$}