Fix overflow detection logic in state filter - #3
Open
AmaliaI12 wants to merge 2 commits into
Open
Conversation
There was a problem hiding this comment.
Pull request overview
This PR aims to make overflow-path detection more reliable in the simulation manager filter so valid overflow states aren’t missed, and it also adjusts several long-running timeout_decorator usages (and some tooling interactions) used during exploration/exploitation flows.
Changes:
- Updates
overflow_detect_filterlogic used by overflow detection during symbolic exploration. - Switches multiple
timeout_decorator.timeout(...)usages touse_signals=Falseand (in some detectors) returns/propagates thesimgr.explore(...)result. - Introduces a binary copy step (named
radare2_binary) before running local processes / fetching register values.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| zeratool_lib/simgr_helper.py | Modifies the overflow state filter logic used to classify/stash vulnerable states. |
| zeratool_lib/overflowRemoteLeaker.py | Adjusts timeout behavior for remote libc leak exploration. |
| zeratool_lib/overflowExploitSender.py | Adds a binary copy step before spawning the local process. |
| zeratool_lib/overflowExploiter.py | Adds a binary copy step and routes getRegValues through it; adjusts timeout behavior. |
| zeratool_lib/overflowDetector.py | Adjusts timeout behavior and captures the returned SimulationManager. |
| zeratool_lib/formatExploiter.py | Adjusts timeout behavior and captures the returned SimulationManager. |
| zeratool_lib/formatDetector.py | Adjusts timeout behavior and captures the returned SimulationManager. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
AmaliaI12
force-pushed
the
AmaliaI12/fix_overflow_detection
branch
3 times, most recently
from
September 1, 2026 20:53
b9afc44 to
77f6f39
Compare
razvand
requested changes
Sep 2, 2026
razvand
left a comment
razvand
left a comment
There was a problem hiding this comment.
Start the commit title with a capital letter, e.g. use "Detect" instead of "detect" or "Enforce" instead of "enforce".
Wrap commit body lines to 72 characters. You should be able to configure your editor to do auto-wrap.
AmaliaI12
force-pushed
the
AmaliaI12/fix_overflow_detection
branch
from
September 2, 2026 16:13
77f6f39 to
70eb41b
Compare
AmaliaI12
force-pushed
the
minor_fixes
branch
from
September 2, 2026 16:17
9206623 to
ba1b516
Compare
Improves the state filter by checking for 'user_input' directly, catching vulnerable paths that lacked the 'overflow_variable' type assignment. Signed-off-by: Amalia Ionescu <ionescu.amalia98@gmail.com>
Generates unique, temporary file paths for binary execution and restricts file permissions to owner-only. This prevents predictable path collisions during parallel execution and mitigates local file tampering vulnerabilities. Signed-off-by: Amalia Ionescu <ionescu.amalia98@gmail.com> Co-authored-by: Github Copilot <copilot@github.com>
AmaliaI12
force-pushed
the
AmaliaI12/fix_overflow_detection
branch
from
September 2, 2026 16:29
70eb41b to
5bbba29
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overflow detection depended on the
typefield being set tooverflow_variablebefore the filter was applied. When the flag was not assigned, some valid overflow paths were ignored.This PR depends on #2 . Please review after #2 is merged.