UAF POI doesn't count uses of subregions about mate

[thinkmoore]

It sounds like the POI analyses didn't run. There's a couple ways you can trigger them:

1. When you use mate-cli oneshot, provide the -p option to run all POIs (https://galoisinc.github.io/MATE/cli.html#cmdoption-mate-cli-oneshot-p)
2. If you've already built the POI, you can use the mate-cli analysis command to run the POIs (or one in particular) (https://galoisinc.github.io/MATE/cli.html#mate-cli-analysis-run)
3. You can use the run_all_analyses endpoint of the Rest API in the Experts tab (https://galoisinc.github.io/MATE/api.html#operation/_run_all_analyses_api_v1_analyses_run__build_id__post

Thanks for giving MATE a try!

[langston-barrett]

MATE showed nothing

@shinmao shared some additional context with me via email, I believe that this means that @shinmao didn't see a graph pre-populated in Flowfinder. This is the expected behavior. Rafael, you might try entering a function name in the "Select a function node to start" box. Then you'll be able to right-click the node that appears and explore the graph.

The Flowfinder tutorial describes this step. There is also a video of someone exploring a program with Flowfinder.

[langston-barrett]

It sounds like the POI analyses didn't run.

It looks like the POIs don't report any findings for this program. I ran them all, they all completed with 0 findings. This may be a bug in our UAF POI query, or Clang may have complied away the undefined behavior---the UAF in this program is fairly trivial (it's an intra-procedural UAF not guarded by a conditional).

[thinkmoore]

After a little more debugging, this is a limitation in the UAF query. Currently, the query it uses to find "uses" doesn't include loads of all sub-regions of the allocation being freed. This isn't a fundamental limitation, and we'll work on a patch. In the meantime, you can experiment with the POI by changing the line msgbox->bye(); to msgbox->welcome();. This will make the load match the current query and return a POI.

Thanks for the question / bug report!

[shinmao]

Sure, thanks. I will try some more examples on it. Keep in touch!

[shinmao]

msgbox->bye();

@thinkmoore Do you mean to change line 71? I tried it but still return nothing. Thanks.