mirror of
https://github.com/brazilofmux/tinymux
synced 2026-08-13 00:23:11 -04:00
39ae5062d7
The emitters run in dropped-write mode on overflow: emit_byte skips the store when offset >= capacity but keeps advancing offset, and translate_block bails post-hoc, discarding the overflowed block. Every RAW backpatch -- a direct e->buf[pos] store rather than an emit_* call -- must therefore bounds-check its patch site, because that site can sit past capacity. #830 established the rule and guarded emit_patch_rel32. The a64 emitter routes its budget-check backpatch through emit_patch_b19, which has carried the guard from the start. emit_loop_budget_check (#1571) in the x64 emitter hand-rolled its short-jump backpatch and missed it -- the one raw backpatch in the x64 emitter without a guard, shared by the sysv and win64 backends via dbt_emit_x64.h. Latent as long as every program switch reset the DBT: the code buffer stayed far from full, so blocks never overflowed mid-translation. #2129's code slots let translations accumulate toward the 4 MB cap, and the bug became a deterministic SIGSEGV -- 2000 commands round-robin over 32 distinct programs, plain muxscript, faulting on the backpatch store in dbt_backend_translate_block. Confirmed causal with the jit_code_slots knob on one binary: slots=1 completes, slots=7 crashes. Only x86-64 hosts could crash, and only an x86-64 host could find it: the guarded-emitter platform (arm64) was the one that could not reach the bug. tests/dbt/test_emit_bounds pins the guard with sentinel bytes past a small capacity -- host-independent, so an arm64 box compiling it still checks the x64 emitter it cannot execute. Catch-verified: with the guard reverted, the two OOB checks go red. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| .gitignore | ||
| build-msvc.sh | ||
| fuzz_diff.cpp | ||
| Makefile | ||
| test_alarm.cpp | ||
| test_cache.cpp | ||
| test_chain.cpp | ||
| test_emit_bounds.cpp | ||
| test_interp.cpp | ||
| test_reloc.cpp | ||