Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Invalid function pointers crash Nidhugg #110

Open
Redhotsmasher opened this issue Apr 16, 2021 · 2 comments
Open

Invalid function pointers crash Nidhugg #110

Redhotsmasher opened this issue Apr 16, 2021 · 2 comments
Labels

Comments

@Redhotsmasher
Copy link

Nidhugg does not detect when the program under test segfaults by attempting to call an invalid function pointer (see MWE attached below). I would expect Nidhugg to detect this and print an error about the program under test causing a segmentation fault (as it does when dereferencing an invalid non-function pointer) but this apparently does not work for function pointers causing Nidhugg itself to segfault.

segfaulttest.zip

@margnus1
Copy link
Contributor

margnus1 commented May 7, 2021

Thank you for your report, your example reproduces the problem nicely.

Because nidhugg is built on top of the llvm interpreter, and the llvm interpreter is not defensively implemented, there are unfortunately these kinds of behaviours in several places.

For this one, I guess we have to validate function pointers towards a list of known functions during indirect calls. I hope that's not hard to do.

@margnus1
Copy link
Contributor

margnus1 commented May 18, 2021

#112 Should fix the issue you're having, but if you don't mind I'll keep this issue open to track that all the general cases have not been addressed.

  • Indirect call/pthread_create/atexit with null function pointer
  • Indirect call/pthread_create/atexit with non-null invalid function pointer
  • Indirect call/pthread_create/atexit with function pointer of wrong type (?)
  • Safe reporting of execution of LLVM's "unreachable" instruction (can result if the program above is compiled with optimisations)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants