search

seahorn / sea-dsa

A new context, field, and array-sensitive heap analysis for LLVM bitcode based on DSA.
Other
157 stars 29 forks source link

fix(DsaGlobal): fixed undefined behavior #147

Closed adrianherrera closed 2 years ago

adrianherrera commented 2 years ago

Popping the front of an std::queue and using the returned reference is undefined behavior (see, for example, https://stackoverflow.com/questions/63599011/getting-reference-of-the-front-element-when-queue-is-popped). Return a copy rather than a reference.

For me, this resulted in a UAF and hence segmentation fault :(

adrianherrera commented 2 years ago

P.S., given the different branches corresponding to different LLVM versions, what is the best way to propagate this fix across all active branches?

caballa commented 2 years ago

I think it's better to do the PR on dev10 and then I can cherry-and-pick to dev11 and dev12. Thanks!

adrianherrera commented 2 years ago

Perfect, thanks! (the reason I'm on dev10 is because of Clam)

caballa commented 2 years ago

Oh I see. Clam has been fully ported to LLVM 11 (dev11). Recently I ported it to LLVM 12 (dev12) although one of its external components (llvm-seahorn) hasn't been ported yet.

adrianherrera commented 2 years ago

Oh cool! Good to know. Thanks Jorge

On Fri, 8 Jul 2022 at 3:36 pm, Jorge Navas @.***> wrote:

Oh I see. Clam has been fully ported to LLVM 11 (dev11). Recently I ported it to LLVM 12 (dev12) although one of its external components (llvm-seahorn) hasn't been ported yet.

— Reply to this email directly, view it on GitHub https://github.com/seahorn/sea-dsa/pull/147#issuecomment-1178573132, or unsubscribe https://github.com/notifications/unsubscribe-auth/ACB2DEX2U73DKQ4U7O6Z3G3VS646FANCNFSM527QIPTQ . You are receiving this because you authored the thread.Message ID: @.***>