|
|
the defect
The eight existing classes check whether a length is bounded, never whether the memory the
length lives in is itself written by a copy, which is exactly the shape of the one real
defect this hunt produced. The new detector models that class.
Its control failed first and was fixed rather than worked around: the back-slice treated a
compare-and-branch-on-zero as a definition of the register and stopped there, missing the
positive control, when in fact those instructions only read their register. With that
corrected the selftest passes on both the positive and negative controls.
The result is two further instances in the same handler, both reading a copy length from
an offset inside the staging buffer that the handler has just filled with message payload,
at an offset that lies within the buffer the accepted format allocates. Every other module
returns zero. Reachability is the same blocker as before, since planting that offset needs
a payload far larger than the constant lengths every trusted application passes.
A limitation is recorded: the destination check is function-local, while the original case
is filled from a different function, so the true corpus count is at least three and a
cross-function version would likely find more.
|
