HVM icon indicating copy to clipboard operation
HVM copied to clipboard

Abmigious Interpretation of 0 pointer?

Open roconnor opened this issue 2 years ago • 0 comments

https://github.com/HigherOrderCO/HVM/blob/a015e25445449da42528a239e13c402abcffaf4c/src/runtime/base/memory.rs#L1-L34 The above comment describes the interpretation of 64-bit Ptr values.

In particular, it says that a tag value of 0 means DP0.

https://github.com/HigherOrderCO/HVM/blob/a015e25445449da42528a239e13c402abcffaf4c/src/runtime/base/memory.rs#L40

Under DP0, the first and second values are the duplication label and the duplication node.

This means a Ptr value of 0, i.e. 0x0000000000000000 means a DP0 value with a label of 0 and pointing to location 0.

On the other hand,

https://github.com/HigherOrderCO/HVM/blob/a015e25445449da42528a239e13c402abcffaf4c/src/runtime/base/memory.rs#L452

and

https://github.com/HigherOrderCO/HVM/blob/a015e25445449da42528a239e13c402abcffaf4c/src/runtime/base/memory.rs#L482

say that a Ptr value of 0 means unallocated memory.

If I understand this all correctly, this can cause a bug where if a DP0 value with label 0 pointing to location 0 is created during evaluation, the allocator will mistake this value a free memory and may potentially overwrite it.

roconnor avatar May 10 '23 14:05 roconnor