[OSS-Fuzz] Issue 28435 qemu:qemu-fuzz-i386-target-generic-fuzz-intel-hda: Stack-overflow in ldl_le_dma
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Invalid
|
Undecided
|
Unassigned |
Bug Description
affects qemu
=== Reproducer (build with --enable-
cat << EOF | ./qemu-system-i386 -machine q35 -nodefaults \
-device intel-hda,id=hda0 -device hda-output,
-device hda-micro,
-qtest stdio
outl 0xcf8 0x80000804
outw 0xcfc 0xffff
write 0x0 0x1 0x12
write 0x2 0x1 0x2f
outl 0xcf8 0x80000811
outl 0xcfc 0x5a6a4406
write 0x6a44005a 0x1 0x11
write 0x6a44005c 0x1 0x3f
write 0x6a442050 0x4 0x0000446a
write 0x6a44204a 0x1 0xf3
write 0x6a44204c 0x1 0xff
writeq 0x6a44005a 0x17b3f0011
write 0x6a442050 0x4 0x0000446a
write 0x6a44204a 0x1 0xf3
write 0x6a44204c 0x1 0xff
EOF
=== Stack Trace ===
==411958==ERROR: AddressSanitizer: stack-overflow on address 0x7ffcaeb8bc88 (pc 0x55c7c9dc1159 bp 0x7ffcaeb8c4d0 sp 0x7ffcaeb8bc90 T0)
#0 0x55c7c9dc1159 in __asan_memcpy (u-system-
#1 0x55c7cb2a457e in flatview_
#2 0x55c7cb2bdab0 in flatview_translate softmmu/
#3 0x55c7cb2bdab0 in flatview_read softmmu/
#4 0x55c7cb2bdab0 in address_
#5 0x55c7caaec937 in dma_memory_
#6 0x55c7caaec937 in dma_memory_rw include/
#7 0x55c7caaec937 in dma_memory_read include/
#8 0x55c7caaec937 in ldl_le_dma include/
#9 0x55c7caaec937 in ldl_le_pci_dma include/
#10 0x55c7caaec937 in intel_hda_corb_run hw/audio/
#11 0x55c7cb2e7198 in memory_
#12 0x55c7cb2e6bd3 in access_
#13 0x55c7cb2e646c in memory_
#14 0x55c7cb2c8445 in flatview_
#15 0x55c7cb2bdfb8 in flatview_write softmmu/
#16 0x55c7cb2bdfb8 in address_space_write softmmu/
#17 0x55c7caae2c54 in dma_memory_
#18 0x55c7caae2c54 in dma_memory_rw include/
#19 0x55c7caae2c54 in dma_memory_write include/
#20 0x55c7caae2c54 in stl_le_dma include/
#21 0x55c7caae2c54 in stl_le_pci_dma include/
#22 0x55c7caae2c54 in intel_hda_response hw/audio/
#23 0x55c7caaeca00 in intel_hda_corb_run hw/audio/
#24 0x55c7cb2e7198 in memory_
...
OSS-Fuzz Report: https:/
I think this [0] commit actually fixes this bug, can someone please confirm it?
[0] https:/ /github. com/qemu/ qemu/commit/ 1bf8b88f144bee7 47e386c88d45d77 2e066bbb36