Skip to content

Commit

Permalink
Fixed: Potential out of bounds read in SIMD scanners
Browse files Browse the repository at this point in the history
The previous code did not correctly account for the initial match of the first byte of the pattern moving the match pointer of up to ('RegisterLength' - 1). This code accounts for this with `(patternVectors.Length + 1) * (RegisterLength)`
  • Loading branch information
Sewer56 committed Aug 2, 2024
1 parent 9760d49 commit 2ddbb2e
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 7 deletions.
9 changes: 3 additions & 6 deletions Reloaded.Memory.Sigscan/Scanner_AVX2.cs
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ public static PatternScanResult FindPatternAvx2(byte* data, int dataLength, stri
int matchTableLength = matchTable.Length;

var firstByteVec = Vector256.Create(patternData.Bytes[patternData.LeadingIgnoreCount]);
int searchLength = dataLength - (patternData.Bytes.Length + AvxRegisterLength);
int searchLength = dataLength - ((patternVectors.Length + 1) * (AvxRegisterLength));

int leadingIgnoreCount = patternData.LeadingIgnoreCount;
ref var pVec = ref patternVectors[0];
Expand All @@ -68,11 +68,8 @@ public static PatternScanResult FindPatternAvx2(byte* data, int dataLength, stri
var dataMaxPtr = dataPtr + searchLength;
for (; dataPtr < dataMaxPtr; dataPtr++)
{
if (dataPtr > (void*)0x00000001778b1000)
{
var a = 5;
}

var lastDataPtr = dataPtr;

// Problem: If pattern starts with unknown, will never match.
var rhs = Avx.LoadVector256(dataPtr);
var equal = Avx2.CompareEqual(pFirstByteVec, rhs);
Expand Down
2 changes: 1 addition & 1 deletion Reloaded.Memory.Sigscan/Scanner_SSE2.cs
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ public static PatternScanResult FindPatternSse2(byte* data, int dataLength, stri
int matchTableLength = matchTable.Length;

var firstByteVec = Vector128.Create(patternData.Bytes[patternData.LeadingIgnoreCount]);
int searchLength = dataLength - (patternData.Bytes.Length + SseRegisterLength);
int searchLength = dataLength - ((patternVectors.Length + 1) * (SseRegisterLength));

int leadingIgnoreCount = patternData.LeadingIgnoreCount;
ref var pVec = ref patternVectors[0];
Expand Down

0 comments on commit 2ddbb2e

Please sign in to comment.