fix a corner case that memcpy copy length is 0

seclab-ucr · Jun 20, 2023 · e481e99 · e481e99
1 parent 7a7eacd
commit e481e99
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/lib/Kernel/Listener/UCListener.cpp b/lib/Kernel/Listener/UCListener.cpp
@@ -1305,6 +1305,13 @@ void kuc::UCListener::OOBWcheck(klee::ExecutionState &state, klee::KInstruction
                 ref<Expr> targetaddr = executor->eval(ki, 1, state).value;
                 ref<Expr> len = executor->eval(ki, 3, state).value;
                 targetaddr = AddExpr::create(targetaddr, len);
+                if(klee::ConstantExpr* CE = dyn_cast<klee::ConstantExpr>(len)){
+                    uint64_t length = CE->getZExtValue();
+                    if (length==0){
+                        klee_message("memcpy copy length is 0, no need to check");
+                        break;
+                    }
+                }
                 targetaddr = SubExpr::create(targetaddr, klee::ConstantExpr::create(1, Context::get().getPointerWidth()));
                 OOB_check(state, targetaddr, 1);
             }