about summary refs log tree commit diff
diff options
context:
space:
mode:
authorPhilipp Bartsch <p.bartsch@sec.tu-bs.de>2019-06-13 14:42:10 +0000
committerPhilipp Bartsch <p.bartsch@sec.tu-bs.de>2019-06-13 14:42:10 +0000
commitf5ba5ffe80c52e448bf162686c21c82f166ab6c0 (patch)
treea419455bd776da1025f0b91783e20c55543b3958
parent0113c4f8342925a02dfc9832de4f7f848d88e190 (diff)
downloadafl++-f5ba5ffe80c52e448bf162686c21c82f166ab6c0.tar.gz
fix zero terminated string issue
In C "strings" are zero terminated. Functions like
strcmp/strncmp/memcmp/... work on them. We have to be careful to not
ignore the last byte.
-rw-r--r--llvm_mode/compare-transform-pass.so.cc14
1 files changed, 7 insertions, 7 deletions
diff --git a/llvm_mode/compare-transform-pass.so.cc b/llvm_mode/compare-transform-pass.so.cc
index c89655ea..d9a1f945 100644
--- a/llvm_mode/compare-transform-pass.so.cc
+++ b/llvm_mode/compare-transform-pass.so.cc
@@ -184,6 +184,7 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp, const
 
     Value *Str1P = callInst->getArgOperand(0), *Str2P = callInst->getArgOperand(1);
     StringRef Str1, Str2, ConstStr;
+    std::string TmpConstStr;
     Value *VarStr;
     bool HasStr1 = getConstantStringInfo(Str1P, Str1);
     getConstantStringInfo(Str2P, Str2);
@@ -202,21 +203,20 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp, const
     }
 
     if (HasStr1) {
-      ConstStr = Str1;
+      TmpConstStr = Str1.str();
       VarStr = Str2P;
       constLen = isMemcmp ? sizedLen : GetStringLength(Str1P);
     }
     else {
-      ConstStr = Str2;
+      TmpConstStr = Str2.str();
       VarStr = Str1P;
       constLen = isMemcmp ? sizedLen : GetStringLength(Str2P);
     }
 
-    /* bugfix thanks to pbst */
-    /* ignore terminating '\0' in string for strcmp */
-    if (!isSizedcmp && constLen > 0) {
-      constLen--;
-    }
+    /* properly handle zero terminated C strings by adding the terminating 0 to
+     * the StringRef (in comparison to std::string a StringRef has built-in
+     * runtime bounds checking, which makes debugging easier) */
+    TmpConstStr.append("\0", 1); ConstStr = StringRef(TmpConstStr);
 
     if (isSizedcmp && constLen > sizedLen) {
       constLen = sizedLen;