diff --git a/fuzzer/Fuzzer.java b/fuzzer/Fuzzer.java index 498dc60a4d1a9e8c4932a51fd62d6f42a2c30e15..1b7181865f9256fc4c54b3d4d6714fb240c30e2a 100644 --- a/fuzzer/Fuzzer.java +++ b/fuzzer/Fuzzer.java @@ -27,9 +27,12 @@ public class Fuzzer { for(int x=0;x<300;x++){ pw.println("ADD R1 R1 R2"); }*/ - pw.println("MOV R1 65535"); + /*pw.println("MOV R1 65535"); pw.println("LDR R0 R1 0"); - pw.println("RET R0"); + pw.println("RET R0");*/ + pw.print("RET R0"); + for(int x=0;x<2000;x++); + pw.print("a"); /*pw.println("ADD R0 R1 R2"); diff --git a/src/machine-vuln1.c b/src/machine-vuln1.c index 4d3cae39532210f43c4393215d09975614592f92..aada30dc82ae029b2401c1ecd9af677ab6e49d70 100644 --- a/src/machine-vuln1.c +++ b/src/machine-vuln1.c @@ -59,7 +59,7 @@ static void machine_init(void){ regs = malloc(sizeof(int32_t)*NUM_REGS); /* memset can be vulnerable - changes to this can result in dirty memory to be read*/ - memset(memory,0,sizeof(int32_t)*(MEMORY_SIZE-2)); + memset(memory,0,sizeof(int32_t)*(MEMORY_SIZE)); memset(regs,0,sizeof(int32_t)*NUM_REGS); count = 0; } @@ -452,14 +452,14 @@ static int read_program(const char *filename){ return -1; } } - if (program[instructionCount][MAX_LINE_LENGTH] != '\0'){ + /*if (program[instructionCount][MAX_LINE_LENGTH] != '\0'){ if (!(program[instructionCount][MAX_LINE_LENGTH] == '\n' && program[instructionCount][MAX_LINE_LENGTH+1] == '\0')){ debug_printf("Line %d exceeds maximum length (%d)\n",instructionCount+1,MAX_LINE_LENGTH); debug_printf("(Expected at array index %d to find NUL but found '%c' (%d))\n",MAX_LINE_LENGTH,program[instructionCount][MAX_LINE_LENGTH],program[instructionCount][MAX_LINE_LENGTH]); fclose(f); return -1; } - }else{ + }else{*/ /* program[instructionCount][MAX_LINE_LENGTH] == '\0', so strlen is guaranteed to be <= MAX_LINE_LENGTH Check if it has a newline and add it if it needs it */ @@ -470,7 +470,7 @@ static int read_program(const char *filename){ program[instructionCount][len+1] = '\0'; } } - } + /*}*/ instructionCount++; }