Add regression tests for Int64 array bounds check bypass#32
Closed
EricGrange wants to merge 1 commit into
Closed
Conversation
TStaticArrayExpr.GetIndex and TDynamicArrayExpr.EvalAsXxx evaluate the index via EvalAsInteger (Int64) but store it into a 32-bit local `Integer` variable before performing the Cardinal-based range check. Any index whose low 32 bits land inside the array length silently bypasses the check and reads/writes the wrong element, so a[$100000000] reads a[0] a[$100000002] := v writes a[2] instead of raising "Upper bound exceeded". Add two ArrayPass scripts that assert the safe behaviour (out-of-bounds exception raised) so the suite goes red until the truncation is fixed at the bounds-check site.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds two regression test cases that verify proper bounds checking for array access with Int64 indices that exceed 32-bit range.
Key Changes
Notable Details
These tests expose a critical security issue in array indexing:
TStaticArrayExpr.GetIndex()evaluates indices as Int64 but truncates to 32-bit Integer before bounds checking, allowing indices like 2^32 to silently access wrong array elementsTDynamicArrayExprevaluation methods similarly declare indices as 32-bit Integer despite receiving Int64 values, bypassing bounds validation for high-value indiceshttps://claude.ai/code/session_013gnFMXw8LzjgJz5eHcyYW6