more

figures/reorder.tex

@@ -0,0 +1,38 @@
+\begin{figure}[H]
+    \centering
+
+\begin{tikzpicture}[scale=0.145]
+\tikzstyle{every node}+=[inner sep=0pt]
+\draw [black] (9.6,-11.8) circle (4.4);
+\draw (9.6,-11.8) node {wait};
+\draw [black] (28.9,-27.9) circle (4.4);
+\draw (28.9,-27.9) node {replay};
+\draw [black] (9.6,-27.9) circle (4.4);
+\draw (9.6,-27.9) node {end};
+\draw [black] (28.9,-11.8) circle (4.4);
+\draw (28.9,-11.8) node {\small{consume}};
+\draw [black] (7.66,-7.87) arc (234:-54:3.3);
+\draw (9.6,-1.4) node [above] {\textit{pass} \texttt{msg} on \texttt{chan}};
+\fill [black] (11.54,-7.87) -- (12.41,-7.52) -- (11.61,-6.93);
+\draw [black] (0.2,-11.8) -- (5.2,-11.8);
+\fill [black] (5.2,-11.8) -- (4.4,-11.3) -- (4.4,-12.3);
+\draw [black] (24.5,-27.9) -- (14,-27.9);
+\fill [black] (14,-27.9) -- (14.8,-28.4) -- (14.8,-27.4);
+\draw (19.25,-28.4) node [below] {\small{\texttt{buf} empty}};
+\draw [black] (32.83,-25.96) arc (144:-144:3.3);
+\draw (39.3,-27.9) node [right, align=center] {\textit{consume} \texttt{msg} from \texttt{buf} \\ \textit{send} \texttt{msg} to \texttt{chan}};
+\fill [black] (32.83,-29.84) -- (33.18,-30.71) -- (33.77,-29.91);
+\draw [black] (28.9,-16.2) -- (28.9,-23.5);
+\fill [black] (28.9,-23.5) -- (29.4,-22.7) -- (28.4,-22.7);
+\draw (29.4,-19.85) node [right] {\texttt{lim=0}};
+\draw [black] (14,-11.8) -- (24.5,-11.8);
+\fill [black] (24.5,-11.8) -- (23.7,-11.3) -- (23.7,-12.3);
+\draw [black] (32.83,-9.86) arc (144:-144:3.3);
+\draw (39.3,-11.8) node [right, align=center] {\textit{consume} \texttt{msg} from \texttt{chan} \\ \textit{add} \texttt{msg} to \texttt{buf} \\ \texttt{lim-=1}};
+\fill [black] (32.83,-13.74) -- (33.18,-14.61) -- (33.77,-13.81);
+\end{tikzpicture}
+
+\caption{High-level state machine diagram of the \textit{reorder} attacker gadget, attacking a channel \texttt{chan}. A natural number \texttt{lim} is pre-defined. \texttt{buf} is a simple FIFO buffer of length \texttt{lim}.}
+  \label{fig:reorder}
+
+\end{figure}