[PATCH v2 1/2] kasan: detect negative size in memory operation function

2019-10-16 Thread Walter Wu
KASAN missed detecting size is negative numbers in memset(), memcpy(), and memmove(), it will cause out-of-bounds bug, so needs to be detected by KASAN. If size is negative numbers, then it has three reasons to be defined as heap-out-of-bounds bug type. 1) Casting negative numbers to size_t would

[PATCH v2 1/2] kasan: detect negative size in memory operation function

2019-10-14 Thread Walter Wu
KASAN missed detecting size is negative numbers in memset(), memcpy(), and memmove(), it will cause out-of-bounds bug, so needs to be detected by KASAN. If size is negative numbers, then it has three reasons to be defined as heap-out-of-bounds bug type. 1) Casting negative numbers to size_t would

[PATCH v2 1/2] kasan: detect negative size in memory operation function

2019-10-14 Thread Walter Wu
KASAN missed detecting size is negative numbers in memset(), memcpy(), and memmove(), it will cause underflow bug, so needs to be detected by KASAN. If size is negative numbers, then it has three reasons to be defined as heap-out-of-bounds bug type. 1) Casting negative numbers to size_t would