File size: 1,002 Bytes
a06a6f8 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 | #include <cstdio>
#include <cstdint>
#include <cstdlib>
#include <vector>
#include <cstring>
// program.cpp:288 plain + vs LoadSegment's add_overflows
int main(){
uint64_t segment_base_offset = 0xFFFFFFFFFFFFFFF0ULL;
uint64_t data_segment_offset = 0x100;
uint64_t sum = segment_base_offset + data_segment_offset; // wraps
fprintf(stderr,"base=%llx off=%llx sum(wrap)=%llx\n",
(unsigned long long)segment_base_offset,
(unsigned long long)data_segment_offset,
(unsigned long long)sum);
// loader sees wrapped offset - may read wrong in-file region
std::vector<char> file(256, 'B');
size_t off = (size_t)sum; // truncated/wrapped
fprintf(stderr,"loader offset as size_t=%zu file_size=%zu\n", off, file.size());
if (off < file.size()) {
volatile char c = file[off];
fprintf(stderr,"read at wrap in-bounds c=%c\n", c);
} else {
// OOB read demonstration
volatile char c = file.data()[off]; // wild
fprintf(stderr,"read c=%d\n", (int)c);
}
return 0;
}
|