File size: 1,002 Bytes
a06a6f8
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
#include <cstdio>
#include <cstdint>
#include <cstdlib>
#include <vector>
#include <cstring>
// program.cpp:288 plain + vs LoadSegment's add_overflows
int main(){
  uint64_t segment_base_offset = 0xFFFFFFFFFFFFFFF0ULL;
  uint64_t data_segment_offset = 0x100;
  uint64_t sum = segment_base_offset + data_segment_offset; // wraps
  fprintf(stderr,"base=%llx off=%llx sum(wrap)=%llx\n",
    (unsigned long long)segment_base_offset,
    (unsigned long long)data_segment_offset,
    (unsigned long long)sum);
  // loader sees wrapped offset - may read wrong in-file region
  std::vector<char> file(256, 'B');
  size_t off = (size_t)sum; // truncated/wrapped
  fprintf(stderr,"loader offset as size_t=%zu file_size=%zu\n", off, file.size());
  if (off < file.size()) {
    volatile char c = file[off];
    fprintf(stderr,"read at wrap in-bounds c=%c\n", c);
  } else {
    // OOB read demonstration
    volatile char c = file.data()[off]; // wild
    fprintf(stderr,"read c=%d\n", (int)c);
  }
  return 0;
}