Skip to content

ffi: Out-of-bound access marshaling structs by value with size and alignment less than word size #53829

Closed
@rmacnak-google

Description

@rmacnak-google

Consider

struct S9 { 
  uint8_t a0;
  uint8_t a1;
  uint8_t a2;
  uint8_t a3;
  uint8_t a4;
  uint8_t a5;
  uint8_t a6;
  uint8_t a7;
  uint8_t a8;
};
extern void Callee(S9);
void Caller(S9* s) {
  Callee(*s);
}

on ARM64. dart:ffi marshals the struct by using two word-sized loads to fill x0 and x1. The struct has only 1-byte alignment, so the last member might be at a page boundary, so using a word load instead of byte load may trigger an access violation.

On Windows ARM64, even if the load succeds, MSVC expects the upper 56 bits of x1 to be zeroed. (As the callee, Clang does not. Both MSVC and Clang ensure these upper bits are zero as the caller.) Using an unsigned byte load during marshaling would ensure the upper bits are zero as MSVC expects.

Metadata

Metadata

Labels

P2A bug or feature request we're likely to work onarea-vmUse area-vm for VM related issues, including code coverage, and the AOT and JIT backends.library-ffitriagedIssue has been triaged by sub team

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions