|
|
Adds fw/ta_lifetime_audit.py, a detector for the three lifetime defect shapes this
round produced, and applies it to all twelve TAs.
The detector was built against real decompiler text rather than imagined patterns,
and two earlier versions failed their own control. The first matched any lvalue and
drowned in loop induction variables, roughly fifty hits that were nearly all ++i in
library code. The second missed the FE0C acquire-gate bug because a neighbouring
handle counter sharing the same base pointer, p_asd_refcount[2] = v9 + 1, looked like
a rollback. The final version restricts the counter class to persistent state,
dereferences, struct fields and indexed slots, and makes the rollback test
direction-aware on the exact lvalue. Only then does it rediscover all three known
GCP defects, which is the condition for trusting anything it says elsewhere.
In GCP it finds two further instances of the FE0F shape:
GetCryptoSessionByDecodeHandle and GetCryptoSessionByUASPHandle, both walking
ctx->crypto for 64 iterations, comparing one field and returning a slot without ever
testing crypto->state. They are reached indirectly through the FE0A and FE09 handlers
rather than through dispatch entries of their own, and both gate on a size field that
the FE0F path does not, so FE0F remains the most directly reachable instance and the
one proven on hardware.
The significance is that a single oversight becomes a pattern: three independent
lookups over the same array written to the same shape, with a liveness field that
exists and is never consulted on any read path, so a fix that patches only FE0F
leaves two more.
|
