diff options
| author | salmonik <salmonik@tuta.io> | 2026-08-02 21:47:18 +0200 |
|---|---|---|
| committer | salmonik <salmonik@tuta.io> | 2026-08-02 21:47:18 +0200 |
| commit | 0187b802113a10a9ee99af48b811cd332c660a13 (patch) | |
| tree | b0873f7b2dcf6be1c575c8fe1919a72f041bba49 /scripts/sendkeys.py | |
| parent | v0.5.6: fault dumps carry kernel image base + stack backtrace (diff) | |
| download | rs-dos-0187b802113a10a9ee99af48b811cd332c660a13.tar.gz rs-dos-0187b802113a10a9ee99af48b811cd332c660a13.zip | |
v0.5.7: allocator corruption guard + full register dump for real-hardware repro
The OptiPlex #GP (vec=13 in __rust_dealloc) frees a garbage pointer: the
back-pointer at [ptr-8] is clobbered by the time the shell drops its
Parsed struct. A blind store to the bogus block header was an opaque
#GP — now it is a readable report:
- dealloc validates the back-pointer (in-heap block, sane size, in-use)
before trusting it; on failure it prints ptr/block/heap range, the
memory around the block header, and the live stack chain, writes the
crash band + crash.log, and halts (memory.rs: heap_guard_report).
- fault dumps now carry the full register set (rax..rdi, rbx, r8..r15)
so the next repro shows the exact freed ptr and clobbered value.
- new 'corrupt' shell hook deliberately clobbers a live block's
back-pointer to prove the guard fires (test-fault-style halt).
Verified: test-msg/test-disk/test-fault pass; corrupt hook reports
ptr=.. block=0xdeedbeef... with mem dump instead of #GP. rs-dos.img
rebuilt with the release kernel.
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions
