nx_ownership_dfree.nx source
↩ module page · 27 lines · 1087 B
1// nx_ownership_dfree.nx -- the DOUBLE-FREE witness for LN5 (nx_ownership_gate).
2//
3// There is no separate double-free rule in this rung, and that is the point: the second sys_munmap
4// has to READ the name to pass it, and that read is the use-after-release the one checker already
5// refuses. CWE-415 falls out of CWE-416 for free, and a fixture is the only way to say so honestly
6// rather than claim it in a comment.
7// Under the default this compiles and runs exit 0 -- 64 bytes is below NXA_SMALL_MAX, so BOTH
8// releases are arena no-ops and the double free is completely invisible at runtime today.
9// license_tier: ORIGINAL No hw writes (Rule 26).
10import "nx_syscalls.nx"
11
12const OWN_DF_BYTES: i64 = 64
13const OWN_DF_MARK: i64 = 13
14
15func own_double_free(seed: i64) -> i64 {
16 let buf: *u8 = sys_mmap(OWN_DF_BYTES)
17 buf[0] = seed as u8
18 let v: i64 = buf[0] as i64
19 sys_munmap(buf, OWN_DF_BYTES)
20 sys_munmap(buf, OWN_DF_BYTES)
21 return v
22}
23
24func main(argc: i64, argv: *i64) -> i64 {
25 if own_double_free(OWN_DF_MARK) != OWN_DF_MARK { return 1 }
26 return 0
27}