diff --git a/src/tools/miri/src/shims/trace/parent.rs b/src/tools/miri/src/shims/trace/parent.rs index a6c19584ef63..d00d77b7b0fc 100644 --- a/src/tools/miri/src/shims/trace/parent.rs +++ b/src/tools/miri/src/shims/trace/parent.rs @@ -555,7 +555,7 @@ fn handle_segfault( // - Continue // Ensure the stack is properly zeroed out! - for a in (ch_stack..ch_stack.strict_add(page_size)).step_by(ARCH_WORD_SIZE) { + for a in (ch_stack..ch_stack.strict_add(FAKE_STACK_SIZE)).step_by(ARCH_WORD_SIZE) { ptrace::write(pid, std::ptr::with_exposed_provenance_mut(a), 0).unwrap(); } @@ -601,6 +601,11 @@ fn handle_segfault( // Also, don't let it continue with unprotected memory if something errors! let _ = wait::waitid(wait::Id::Pid(pid), WAIT_FLAGS).map_err(|_| ExecError::Died(None))?; + // Zero out again to be safe + for a in (ch_stack..ch_stack.strict_add(FAKE_STACK_SIZE)).step_by(ARCH_WORD_SIZE) { + ptrace::write(pid, std::ptr::with_exposed_provenance_mut(a), 0).unwrap(); + } + // Save registers and grab the bytes that were executed. This would // be really nasty if it was a jump or similar but those thankfully // won't do memory accesses and so can't trigger this!