Closed hbrodin closed 1 year ago
https://github.com/trailofbits/polytracker/blob/master/polytracker/src/taint_sources/taint_sources.cpp#L143-L153
EXT_C_FUNC ssize_t __dfsw_read(int fd, void *buff, size_t size, dfsan_label fd_label, dfsan_label buff_label, dfsan_label size_label, dfsan_label *ret_label) { long read_start = lseek(fd, 0, SEEK_CUR); ssize_t ret_val = read(fd, buff, size); if (ret_val > 0) get_polytracker_tdag().source_taint(fd, buff, read_start, ret_val); return ret_val; }
Does not assign to the ret_label causing it to return with an arbitrary value. Follow-on errors include
ret_label
[2022-11-09 12:04:17.377] [error] Decoding invalid taint value, 0 == 0 encoded: 0
I have a fix pending in the upcoming PR for #6488.
https://github.com/trailofbits/polytracker/blob/master/polytracker/src/taint_sources/taint_sources.cpp#L143-L153
Does not assign to the
ret_label
causing it to return with an arbitrary value. Follow-on errors include