Skip to content

fix(BytesOp::Find): fix slice index overflow #82

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dr-orlovsky merged 6 commits into from
Jun 26, 2023
Merged

fix(BytesOp::Find): fix slice index overflow #82

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
34bc087
fix(BytesOp::Find): fix slice index overflow
6293 Jun 21, 2023
66bd8dd
fix(BytesOp::Find): it never overflows destination register because t…
6293 Jun 21, 2023
b45b2c1
use window function
6293 Jun 21, 2023
9c5bb40
fix(BytesOp::Rev): do not set None to RegA on failure
6293 Jun 24, 2023
3a44520
fix(DigestOp::Ripemd): reverse byte array because RIPEMD-160 is big-e…
6293 Jun 24, 2023
34b518a
fix(BytesOp::Rev): set dest to None on failure
6293 Jun 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 5 additions & 7 deletions src/isa/exec.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -669,17 +669,15 @@ impl InstructionSet for BytesOp {
let (s1, s2) = regs.get_both_s(*reg1, *reg2)?;
let r1 = s1.as_ref();
let r2 = s2.as_ref();
let len = r2.len();
let r1_len = r1.len();
let r2_len = r2.len();
let mut count = 0usize;
for i in 0..r1.len() {
if r1[i..len] == r2[..len] {
for i in 0..(r1_len + 1).saturating_sub(r2_len) {
Copy link
Copy Markdown
Member

@dr-orlovsky dr-orlovsky Jun 21, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

r1_len + 1 can also panic (in debug) or overflow (in release)

Copy link
Copy Markdown
Contributor Author

@6293 6293 Jun 21, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

r1_len is at most u16::MAX (because it is ByteStr) stored as usize. so it will not overflow on +1

Copy link
Copy Markdown
Contributor Author

@6293 6293 Jun 21, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

but I have to admit this is error prone. fixing it

if &r1[i..(i + r2_len)] == r2 {
count += 1;
}
}
if count > u16::MAX as usize {
regs.st0 = false;
count -= 1;
}
assert!(count <= u16::MAX as usize);
regs.set(RegA::A16, Reg32::Reg0, count as u16);
Some(())
};
Expand Down
9 changes: 3 additions & 6 deletions src/isa/instr.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -677,13 +677,10 @@ pub enum BytesOp {
/** `a16` register index to save the length of the conjoint fragment */ Reg32,
),

/// Count number of occurrences of one string within another putting result to `a16[1]`,
/// Count number of occurrences of one string within another putting result to `a16[0]`,
///
/// If the first or the second string is `None`, sets `st0` to `false` and `a16[1]` to `None`.
///
/// If the number of occurrences is `u16::MAX + 1`, sets `a16[1]` to `u16::MAX` and `st0` to
/// `false`.
#[display("find {0},{1},a16[1]")]
/// If the first or the second string is `None`, sets `st0` to `false` and `a16[0]` to `None`.
#[display("find a16[0],{0},{1}")]
Find(/** `s` register with string */ RegS, /** `s` register with matching fragment */ RegS),

/// Extract byte string slice into general `r` register. The length of the extracted string is
Expand Down