Download offset_add_repro.cpp from ybgwon96/executorch-constseg-offset-oob-poc: direct link, hf CLI and curl.
- Browser
- Download file 1 kB
-
https://huggingface.co/ybgwon96/executorch-constseg-offset-oob-poc/resolve/main/offset_add_repro.cpp
- Command line
-
hf download hf://ybgwon96/executorch-constseg-offset-oob-poc/offset_add_repro.cpp
-
curl -L -o offset_add_repro.cpp https://huggingface.co/ybgwon96/executorch-constseg-offset-oob-poc/resolve/main/offset_add_repro.cpp
1 kB
| // program.cpp:288 plain + vs LoadSegment's add_overflows | |
| int main(){ | |
| uint64_t segment_base_offset = 0xFFFFFFFFFFFFFFF0ULL; | |
| uint64_t data_segment_offset = 0x100; | |
| uint64_t sum = segment_base_offset + data_segment_offset; // wraps | |
| fprintf(stderr,"base=%llx off=%llx sum(wrap)=%llx\n", | |
| (unsigned long long)segment_base_offset, | |
| (unsigned long long)data_segment_offset, | |
| (unsigned long long)sum); | |
| // loader sees wrapped offset - may read wrong in-file region | |
| std::vector<char> file(256, 'B'); | |
| size_t off = (size_t)sum; // truncated/wrapped | |
| fprintf(stderr,"loader offset as size_t=%zu file_size=%zu\n", off, file.size()); | |
| if (off < file.size()) { | |
| volatile char c = file[off]; | |
| fprintf(stderr,"read at wrap in-bounds c=%c\n", c); | |
| } else { | |
| // OOB read demonstration | |
| volatile char c = file.data()[off]; // wild | |
| fprintf(stderr,"read c=%d\n", (int)c); | |
| } | |
| return 0; | |
| } | |