code wiki / (root) / nx_ownership_dfree.nx

nx_ownership_dfree.nx

buildroot/runtime/nx_ownership_dfree.nx

1087 B27 linesdepth 2pulls 2 transitivereach 0 importersview sourcekind tooltopic ownership
docsdependenciesstructsconstsfunctions

about

nx_ownership_dfree.nx -- the DOUBLE-FREE witness for LN5 (nx_ownership_gate). There is no separate double-free rule in this rung, and that is the point: the second sys_munmap has to READ the name to pass it, and that read is the use-after-release the one checker already refuses. CWE-415 falls out of CWE-416 for free, and a fixture is the only way to say so honestly rather than claim it in a comment. Under the default this compiles and runs exit 0 -- 64 bytes is below NXA_SMALL_MAX, so BOTH releases are arena no-ops and the double free is completely invisible at runtime today. license_tier: ORIGINAL No hw writes (Rule 26).

dependencies 1 imports · 0 importers

nx_syscalls.nx nx_ownership_dfree.nx

imports: nx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main own_double_free sys_mmap nxa_die sys_write sys_exit nxa_lock_take nxa_lock_addr sys_write ↻ nxa_lock_give nxa_lock_addr ↻ nxa_report_overrun sys_write ↻ nxa_dump_printable sys_write ↻ nxa_dump_sizes sys_write ↻ sys_munmap

structs

none

consts

12const OWN_DF_BYTES: i64 = 64
13const OWN_DF_MARK: i64 = 13

functions

15func own_double_free(seed: i64) -> i64
called by 1: main calls 2: sys_mmapsys_munmap
24func main(argc: i64, argv: *i64) -> i64
calls 1: own_double_free