vbpf / prevail / 24307155209

89%

push

github

Fix stack numeric size lost through imprecise pointer stores (#1068)

When a store occurs through a derived stack pointer whose offset is an
imprecise range (e.g., [504, 508] after loop widening), store_type()
would unconditionally havoc num_bytes for the entire range. This
destroyed previously-proven numeric status for those bytes, causing
subsequent helpers to fail with 'Stack content is not numeric' because
stack_numeric_size could not be recomputed from the damaged num_bytes.

Fix: only havoc num_bytes when the stored value is NOT numeric. When
the value IS numeric, leave num_bytes unchanged — the written bytes
remain numeric (they were overwritten with a numeric value), and the
unwritten bytes retain their previous status. This is sound because
no byte transitions from non-numeric to numeric (we do not set new
num_bytes bits), and no byte transitions from numeric to non-numeric
(the stored value is numeric).

Signed-off-by: Michael Agun <danielagun@microsoft.com>

2 of 2 new or added lines in 1 file covered. (100.0%)

13388 of 15021 relevant lines covered (89.13%)

4586774.77 hits per line