|
|
out-of-bounds writes
The previous pass settled the undersized case as a hang rather than an out-of-bounds
write, leaving the opposite direction untested even though it is the corruption shape,
since the load command accepts a declared length far larger than the allocation and the
processor trusting that number would place output past memory the host actually
allocated.
Allocating a region, guard-filling all of it, declaring a length eight times larger and
invoking commands known to produce output shows every command writes only its normal small
output within the buffer and nothing lands beyond the allocation, with controls passing
since each command demonstrably wrote. The processor writes what the command produces
rather than what the host declared.
Both directions of a mis-declared window are therefore closed, under-declared hanging
without an out-of-bounds write and over-declared leaving output unchanged, which removes
the last plausible route by which a host-controlled length could become a write outside a
host buffer. The objective is not met.
|
