trailofbits / polytracker

An LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.
Apache License 2.0
532 stars 46 forks source link

DFSAN wrapper for `read` does not assign a return value label #6501

Closed hbrodin closed 1 year ago

hbrodin commented 1 year ago

https://github.com/trailofbits/polytracker/blob/master/polytracker/src/taint_sources/taint_sources.cpp#L143-L153

EXT_C_FUNC ssize_t __dfsw_read(int fd, void *buff, size_t size,
                               dfsan_label fd_label, dfsan_label buff_label,
                               dfsan_label size_label, dfsan_label *ret_label) {
  long read_start = lseek(fd, 0, SEEK_CUR);
  ssize_t ret_val = read(fd, buff, size);

  if (ret_val > 0)
    get_polytracker_tdag().source_taint(fd, buff, read_start, ret_val);

  return ret_val;
}

Does not assign to the ret_label causing it to return with an arbitrary value. Follow-on errors include

[2022-11-09 12:04:17.377] [error] Decoding invalid taint value, 0 == 0 encoded: 0
hbrodin commented 1 year ago

I have a fix pending in the upcoming PR for #6488.