Skip to content

Commit

Permalink
fix: Memory loading crash for certain program (#392)
Browse files Browse the repository at this point in the history
  • Loading branch information
mohanson authored Dec 15, 2023
1 parent 3e3d974 commit d263bba
Show file tree
Hide file tree
Showing 4 changed files with 21 additions and 7 deletions.
17 changes: 10 additions & 7 deletions src/machine/asm/mod.rs
Original file line number Diff line number Diff line change
Expand Up @@ -212,13 +212,16 @@ impl<'a> FastMemory<'a> {
check_memory(self.0, addr >> RISCV_PAGE_SHIFTS);
}
let end = addr.wrapping_add(size);
let aligned_end = round_page_down(end);
let frame_next_start = ((end >> MEMORY_FRAME_SHIFTS) + 1) << MEMORY_FRAME_SHIFTS;
// There is some memory space between the ending address of memory to be
// written, and the end of the last memory frame touched, we will need to
// initialize the last memory frame.
if (aligned_end + RISCV_PAGESIZE as u64) < frame_next_start {
check_memory(self.0, aligned_end >> RISCV_PAGE_SHIFTS);
if end > 0 {
let aligned_end = round_page_down(end);
// Note that end is exclusive
let frame_next_start = (((end - 1) >> MEMORY_FRAME_SHIFTS) + 1) << MEMORY_FRAME_SHIFTS;
// There is some memory space between the ending address of memory to be
// written, and the end of the last memory frame touched, we will need to
// initialize the last memory frame.
if (aligned_end + RISCV_PAGESIZE as u64) < frame_next_start {
check_memory(self.0, aligned_end >> RISCV_PAGE_SHIFTS);
}
}
let page_indices = get_page_indices(addr, size);
for page in page_indices.0..=page_indices.1 {
Expand Down
Binary file added tests/programs/memory_crash
Binary file not shown.
1 change: 1 addition & 0 deletions tests/programs/memory_crash.md
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
This file comes from a fuzzing test.
10 changes: 10 additions & 0 deletions tests/test_asm.rs
Original file line number Diff line number Diff line change
Expand Up @@ -503,3 +503,13 @@ fn test_fast_memory_initialization_bug() {
machine.load_program(&buffer, &[]).unwrap();
assert_eq!(machine.machine.memory_mut().load8(&0).unwrap(), 0);
}

#[test]
pub fn test_memory_load_crash() {
let buffer = fs::read("tests/programs/memory_crash").unwrap().into();
let asm_core = AsmCoreMachine::new(ISA_IMC, VERSION0, u64::max_value());
let core = DefaultMachineBuilder::new(asm_core).build();
let mut machine = AsmMachine::new(core);
let result = machine.load_program(&buffer, &vec!["memory_crash".into()]);
assert_eq!(result.unwrap_err(), Error::MemWriteOnExecutablePage);
}

0 comments on commit d263bba

Please sign in to comment.