russell@unturf.com
6b03516ecb
Reader's .sr_string used a fixed 256-byte stack buffer with no
bounds check. Strings longer than ~272 bytes (256 + saved
registers) corrupted the saved return address and produced a
general protection fault on ret.
Reproducer:
(display (string-length "AAAA...")) ; > 272 A's → #GP at .sr_string ret
Fix:
- bump stack buffer 256 → 4096 (one page)
- add bounds check (cmpq $4080) before every char write
- on overflow exit cleanly via new die_str_overflow rather than
smashing %rip
Discovered while diagnosing ecdsa task #34: lumbda asm tier
crashed when loading ecdsa/lumbda/mod-arith.lsp because one
mod-mul! docstring is 955 bytes. Post-fix, mod-arith.lsp loads
clean and ecdsa test-mod-arith.lsp passes 33/33 on asm-full;
upstream asm test.sh stays 158/158.
|
||
|---|---|---|
| .. | ||
| lumbda | ||
| lumbda-full | ||
| lumbda-full.o | ||
| lumbda-gc | ||
| lumbda-gc.o | ||
| lumbda.o | ||
| lumbda.s | ||
| Makefile | ||
| test.sh | ||