Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jitted code doesn't check if slice index is in bounds #19

Open
mateon1 opened this issue Oct 23, 2017 · 1 comment
Open

Jitted code doesn't check if slice index is in bounds #19

mateon1 opened this issue Oct 23, 2017 · 1 comment

Comments

@mateon1
Copy link

mateon1 commented Oct 23, 2017

With this program eval(jc, "-[>-[>-<-]<-]<-]".into()), the brainfuck interpreter panics, because it sees an unknown symbol at the program counter (garbage memory)
With eval(jc, "-[>-[>-[>-<-]<-]<-]<-]".into()) - the program receives a SIGSEGV, caused by a read of one byte before an allocated page.

I'll try to run these with ASAN and report the results

EDIT: I can't build with ASAN, because kernel32-sys fails to link. Brainfart, I need to pass the --target flag, but holyjit also fails to link.
EDIT2: I just realized the brackets in these programs are mismatched, which means bounds checks aren't emitted properly under jit!()

@mateon1 mateon1 changed the title Bad memory access (garbage & SIGSEGV) in brainfuck example Jitted code doesn't check if slice index is in bounds Oct 23, 2017
@nbp
Copy link
Owner

nbp commented Oct 23, 2017

I usually use rr to debug the generate code, as you can walk the code execution backward.

I can reproduce this issue. I got a SEGV which corresponds to the panic with the message "Unknown Symbol". The problem likely comes from the code which is being produced by the array access[1], which is probably always checked, but never appear in the MIR.

[1]

mir::ProjectionElem::Index(ref operand) => {

@nbp nbp added this to the v0.1.0: Cranelift + LIR milestone Aug 18, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants