nx_ownership_alias.nx source
↩ module page · 25 lines · 993 B
1// nx_ownership_alias.nx -- the ALIAS-SWEEP witness for LN5 (nx_ownership_gate).
2//
3// `q` is a second name for one buffer. `p` is released. `q` is read anyway. A checker that marked
4// only the name written inside the sys_munmap would report NOTHING here -- and this is not an exotic
5// shape, it is what `let q = p` means. The refusal must name `q`, the name at the use, not `p`.
6// Under the default this compiles and runs exit 0 (64 bytes is below NXA_SMALL_MAX, so the release
7// is an arena no-op) -- the same false comfort the main fixture records.
8// license_tier: ORIGINAL No hw writes (Rule 26).
9import "nx_syscalls.nx"
10
11const OWN_AL_BYTES: i64 = 64
12const OWN_AL_MARK: i64 = 11
13
14func own_alias_uaf(seed: i64) -> i64 {
15 let p: *u8 = sys_mmap(OWN_AL_BYTES)
16 let q: *u8 = p
17 p[0] = seed as u8
18 sys_munmap(p, OWN_AL_BYTES)
19 return q[0] as i64
20}
21
22func main(argc: i64, argv: *i64) -> i64 {
23 if own_alias_uaf(OWN_AL_MARK) != OWN_AL_MARK { return 1 }
24 return 0
25}