Open
Description
I audited the source code for this project. I found DIV doesn't limit the zero. For instance, below is an example.
`
case DIV: {
registers[A] = stack[SP];
SP = SP - 1;
registers[B] = stack[SP];
/* SP = SP - 1;*/
printf("registera:%d\n",registers[A]);
registers[C] = registers[B] / registers[A];
/* SP = SP + 1; */
stack[SP] = registers[C];
printf("%d / %d = %d\n", registers[B], registers[A], registers[C]);
break;
}
I can control the register[A] into zero, which will cause the DIV zero issue.
[mac]% ./mac DIVZero_poc.mac
[1] 34092 floating point exception ./mac DIVZero_poc.mac
`
I have attached my poc.
DIVZero_poc.mac.zip
Metadata
Metadata
Assignees
Labels
No labels