trailofbits / binary_type_inference

GNU General Public License v3.0
15 stars 2 forks source link

Handle unbounded points to information more soundly #48

Closed 2over12 closed 2 years ago

2over12 commented 2 years ago

The question here is how to handle writes to an abstract location that are unbounded. Currently, for an abstract object named RSI we do RSI <= thing.load.@0sigma_size. This approach doesnt work well if some writes are bounded. then we will get RSI@0sigma_size <= thing.load.@0sigma_size. If the program is type safe wrt to our model these two types must be equal. But that's going to result in a reflexive edge with a field to the abstract object.

Ideas of how to handle this:

2over12 commented 2 years ago

I dont think unbounding everything is correct i think maybe the correct call is to not produce points to constraints for unbounded writes.

2over12 commented 2 years ago

Closed by #49