Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Require a balanced heap state at join points. #219

Merged
merged 1 commit into from May 30, 2018

Conversation

@dvander
Copy link
Member

dvander commented May 30, 2018

We can require a balanced HEA state in addition to STK. Heap allocations can be dynamic, which makes this a bit more complicated. We need to correctly interleave static and dynamic allocations, which requires a stack.

The really annoying problem, though, is that the compiler had a bug for 12 years where dynamic arrays were not freed on "break" statements inside loops. This messes up our analysis because the join point will see an empty heap state on one predecessor, and lingering dynamic variables in the other.

Two plugins in my corpus were affected by this bug. One of them still had the source code available, and I was able to work around it by detecting break statements and ignoring the balancing error. (I think it is okay, in this case, to pick a random predecessor's state to inherit, because the only entries should be extra dynamic entries.)

I could not find the source to the other plugin, and I can't tell what's going on from its control flow. It's found in attachments 138975, 146934, 150386, and 150800. It appears to be a discontinued deathmatch plugin by H3bus, and the thread for it has been scrubbed. Given that these binaries were made between 10/2014 and 12/2015, for SourceMod 1.6.2, I think I'm okay making it fail validation. But I'll keep an eye out for cases where the bug detection does not work.

@dvander dvander merged commit 5934c95 into master May 30, 2018
2 checks passed
2 checks passed
continuous-integration/appveyor/pr AppVeyor build succeeded
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
@dvander dvander deleted the cfg branch May 30, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
1 participant
You can’t perform that action at this time.