mirror of
https://github.com/angr/angr
synced 2026-08-17 12:23:11 -04:00
55530509ce
SimLinux.state_blank pre-grows the stack by a fixed 0x20 pages without
checking that 0x20 pages exist beneath the stack pointer. When they do
not, the allocation loop wraps past address 0 and hands out the remainder
at the top of the address space.
On x86-64 that is silent: blank_state(stack_end=0x10000) maps sixteen
stack pages from 0x0 up and sixteen more from 0xfffffffffffff000 down.
Where the wrap reaches a page the same call already handed out, the state
fails with SimSegfaultException("stack collided with heap") instead, and
where it reaches the loaded image it replaces it with blank pages.
Skip the pre-grow when that much space does not exist. Clamping it to the
space that does exist is not an option: the pre-allocated pages are not
backed by the loader, so a stack that reaches down to an image beneath it
hides that image. The pages that are skipped are still faulted in on
demand.
Also reject an allocation that does not fit beneath the top of the stack
in allocate_stack_pages() itself, so a caller that asks for one gets an
error rather than pages at the top of the address space.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| __init__.py | ||
| test_address_concretization.py | ||
| test_memory.py | ||
| test_memory_find_6744.py | ||
| test_memory_merge.py | ||
| test_memview.py | ||
| test_mmap.py | ||
| test_multivalues.py | ||
| test_permissions.py | ||
| test_ptmalloc.py | ||
| test_relro_perm.py | ||