code wiki / (root) / nx_ownership_alias.nx

nx_ownership_alias.nx source

↩ module page · 25 lines · 993 B

1// nx_ownership_alias.nx -- the ALIAS-SWEEP witness for LN5 (nx_ownership_gate). 2// 3// `q` is a second name for one buffer. `p` is released. `q` is read anyway. A checker that marked 4// only the name written inside the sys_munmap would report NOTHING here -- and this is not an exotic 5// shape, it is what `let q = p` means. The refusal must name `q`, the name at the use, not `p`. 6// Under the default this compiles and runs exit 0 (64 bytes is below NXA_SMALL_MAX, so the release 7// is an arena no-op) -- the same false comfort the main fixture records. 8// license_tier: ORIGINAL No hw writes (Rule 26). 9import "nx_syscalls.nx" 10 11const OWN_AL_BYTES: i64 = 64 12const OWN_AL_MARK: i64 = 11 13 14func own_alias_uaf(seed: i64) -> i64 { 15 let p: *u8 = sys_mmap(OWN_AL_BYTES) 16 let q: *u8 = p 17 p[0] = seed as u8 18 sys_munmap(p, OWN_AL_BYTES) 19 return q[0] as i64 20} 21 22func main(argc: i64, argv: *i64) -> i64 { 23 if own_alias_uaf(OWN_AL_MARK) != OWN_AL_MARK { return 1 } 24 return 0 25}