You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
For AArch64, sp must be 16-byte aligned whenever it is used to access memory.
This is enforced by AArch64 hardware.
However, the code generated by pwnlib.shellcraft.pushstr_array() causes sp to be misaligned by 8.
Here's the output of the function:
The bug happens at line 14, and the bus error is thrown at line 19. Line 14 uses str register to memory with an exclamation mark, thus causing sp to be misaligned by 8 bytes when pushing the first pointer. At line 19, there's another usage of str register to memory to push the second pointer, when sp is misaligned, thus throwing a bus error. This should be fixed by not "pushing" the pointers to the stack, but rather allocating 16-byte aligned memory on the stack (decreasing sp), then writing the pointers without modifying sp, and then adding a null byte padding if necessary.
The text was updated successfully, but these errors were encountered:
Hey,
The pwnlib.shellcraft.pushstr_array() causes stack misalignment when pushing pointes and causes a bus error when executed.
As seen here:
However, the code generated by pwnlib.shellcraft.pushstr_array() causes sp to be misaligned by 8.

Here's the output of the function:
The bug happens at line 14, and the bus error is thrown at line 19. Line 14 uses str register to memory with an exclamation mark, thus causing sp to be misaligned by 8 bytes when pushing the first pointer. At line 19, there's another usage of str register to memory to push the second pointer, when sp is misaligned, thus throwing a bus error. This should be fixed by not "pushing" the pointers to the stack, but rather allocating 16-byte aligned memory on the stack (decreasing sp), then writing the pointers without modifying sp, and then adding a null byte padding if necessary.
The text was updated successfully, but these errors were encountered: