FBI bugs

panda-re · Aug 27, 2024 · a58570d · a58570d
1 parent 6f977df
commit a58570d
Showing 1 changed file with 9 additions and 5 deletions.
diff --git a/tools/fbi/src/find_bug_inj.cpp b/tools/fbi/src/find_bug_inj.cpp
@@ -545,7 +545,8 @@ void taint_query_pri(Json::Value& ple) {
         // looks like we can subvert this for either real or fake bug.
         // NB: we don't know liveness info yet. defer byte selection until later.
         assert(si.isMember("astLocId"));
-        LavaASTLoc ast_loc(si["astLocId"].asString());
+        unsigned long ast_loc_id = std::strtoul(si["astLocId"].asString().c_str(), 0, 0);
+        LavaASTLoc ast_loc(ind2str[ast_loc_id]);
         assert(ast_loc.filename.size() > 0);
 
         const SourceLval *lval = create(SourceLval{0, ast_loc, si["astnodename"].asString(), len});
@@ -859,13 +860,16 @@ void record_injectable_bugs_at(const AttackPoint *atp, bool is_new_atp,
 
 void attack_point_lval_usage(Json::Value ple) {
     Json::Value pleatp = ple["attackPoint"];
-    if (pleatp["src_info"].isMember("astLocId")) {
-        dprintf ("attack point id = %lu\n", std::strtoul(pleatp["srcInfo"]["astLocId"].asString().c_str(), 0, 0));
+    unsigned long ast_id;
+
+    if (pleatp["srcInfo"].isMember("astLocId")) {
+        ast_id = std::strtoul(pleatp["srcInfo"]["astLocId"].asString().c_str(), 0, 0);
+        dprintf ("attack point id = %lu\n", ast_id);
     }
     Json::Value si = pleatp["srcInfo"];
     // ignore duas in header files
     if (is_header_file(si["filename"].asString())) {
-	return;
+	    return;
     }
     // assert (si.isMember("srcInfo");
     dprintf("ATTACK POINT\n");
@@ -876,7 +880,7 @@ void attack_point_lval_usage(Json::Value ple) {
 
     dprintf("%lu viable duas remain\n", recent_dead_duas.size());
     assert(si.isMember("astLocId"));
-    LavaASTLoc ast_loc(si["astLocId"].asString());
+    LavaASTLoc ast_loc(ind2str[ast_id]);
     assert(ast_loc.filename.size() > 0);
     transaction t(db->begin());
     const AttackPoint *atp;