ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-09 16:51:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix numeric overflow in cmplog implementation (#907)

Browse Source 
Co-authored-by: Your Name <you@example.com>
This commit is contained in:
WorksButNotTested 2021-05-08 14:30:07 +01:00 committed by GitHub
parent 1b7aa1b63b
commit 6c20d54b23
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
frida_mode/src/cmplog/cmplog_x64.c
View File

@ -175,6 +175,8 @@ static void cmplog_call_callout(GumCpuContext *context, gpointer user_data) {
guint64 rdi = cmplog_read_reg(context, X86_REG_RDI); guint64 rdi = cmplog_read_reg(context, X86_REG_RDI);
guint64 rsi = cmplog_read_reg(context, X86_REG_RSI); guint64 rsi = cmplog_read_reg(context, X86_REG_RSI);
if (((G_MAXULONG - rdi) < 32) || ((G_MAXULONG - rsi) < 32)) return;
void *ptr1 = GSIZE_TO_POINTER(rdi); void *ptr1 = GSIZE_TO_POINTER(rdi);
void *ptr2 = GSIZE_TO_POINTER(rsi); void *ptr2 = GSIZE_TO_POINTER(rsi);
@ -223,18 +225,6 @@ static void cmplog_instrument_put_operand(cmplog_ctx_t *ctx,
} }
static void cmplog_instrument_call_put_callout(GumStalkerIterator *iterator,
cs_x86_op * operand) {
cmplog_ctx_t *ctx = g_malloc(sizeof(cmplog_ctx_t));
if (ctx == NULL) return;
cmplog_instrument_put_operand(ctx, operand);
gum_stalker_iterator_put_callout(iterator, cmplog_call_callout, ctx, g_free);
}
static void cmplog_instrument_call(const cs_insn * instr, static void cmplog_instrument_call(const cs_insn * instr,
GumStalkerIterator *iterator) { GumStalkerIterator *iterator) {
@ -251,7 +241,7 @@ static void cmplog_instrument_call(const cs_insn * instr,
if (operand->type == X86_OP_MEM && operand->mem.segment != X86_REG_INVALID) if (operand->type == X86_OP_MEM && operand->mem.segment != X86_REG_INVALID)
return; return;
cmplog_instrument_call_put_callout(iterator, operand); gum_stalker_iterator_put_callout(iterator, cmplog_call_callout, NULL, NULL);
} }