Heap-overflow (read) in sd_erase
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| QEMU |
Fix Released
|
Undecided
|
Unassigned | ||
Bug Description
Hello,
One more bug in sd ...
cat << EOF | ./qemu-system-i386 -nodefaults \
-device sdhci-pci,
-device sd-card,
-drive if=sd,index=
-nographic -qtest stdio -m 64m -trace 'sd*'
outl 0xcf8 0x80001003
outl 0xcfc 0xd735d735
outl 0xcf8 0x80001011
outl 0xcfc 0x3405064c
write 0x5064c2c 0x1 0xd7
write 0x5064c0f 0x1 0xf7
write 0x5064c05 0x1 0xd7
write 0x5064c0a 0x1 0x84
write 0x5064c0b 0x1 0x4c
write 0x5064c0c 0x1 0x11
write 0x5064c0f 0x1 0xa9
write 0x5064c0f 0x1 0x02
write 0x5064c0f 0x1 0x03
write 0x5064c0e 0x1 0x2c
write 0x5064c0f 0x1 0x06
write 0x5064c0f 0x1 0xe1
write 0x5064c0f 0x1 0x60
write 0x5064c0f 0x1 0x26
EOF
The crash:
==133840==ERROR: AddressSanitizer: heap-buffer-
READ of size 8 at 0x607000059e78 thread T0
#0 0x55abd1d761e5 in test_bit /home/alxndr/
#1 0x55abd1d6cb1e in sd_erase /home/alxndr/
#2 0x55abd1d4c893 in sd_normal_command /home/alxndr/
#3 0x55abd1d33c5d in sd_do_command /home/alxndr/
#4 0x55abd20117a4 in sdbus_do_command /home/alxndr/
#5 0x55abd27ecc90 in sdhci_send_command /home/alxndr/
#6 0x55abd27e16ed in sdhci_write /home/alxndr/
#7 0x55abd43aacc0 in memory_
#8 0x55abd43aa19d in access_
#9 0x55abd43a7e50 in memory_
#10 0x55abd3de5dc6 in flatview_
#11 0x55abd3dced98 in flatview_write /home/alxndr/
#12 0x55abd3dce8c8 in address_space_write /home/alxndr/
#13 0x55abd3ffabbc in qtest_process_
#14 0x55abd3feb8be in qtest_process_inbuf /home/alxndr/
#15 0x55abd3fea663 in qtest_read /home/alxndr/
#16 0x55abd51cb9a2 in qemu_chr_
#17 0x55abd51cbaea in qemu_chr_be_write /home/alxndr/
#18 0x55abd51e6264 in fd_chr_read /home/alxndr/
#19 0x55abd515bef6 in qio_channel_
#20 0x7fd5d58bd4cd in g_main_
#21 0x55abd54db327 in glib_pollfds_poll /home/alxndr/
#22 0x55abd54d8c27 in os_host_
#23 0x55abd54d8607 in main_loop_wait /home/alxndr/
#24 0x55abd3d55afd in qemu_main_loop /home/alxndr/
#25 0x55abd16df67c in main /home/alxndr/
#26 0x7fd5d4ec0cc9 in __libc_start_main csu/../
#27 0x55abd1634e59 in _start (/home/
0x607000059e78 is located 0 bytes to the right of 72-byte region [0x607000059e30
allocated by thread T0 here:
#0 0x55abd16ad712 in calloc (/home/
#1 0x55abd1d75464 in bitmap_try_new /home/alxndr/
#2 0x55abd1d74bd4 in bitmap_new /home/alxndr/
#3 0x55abd1d67b68 in sd_reset /home/alxndr/
#4 0x55abd47f34b2 in device_
#5 0x55abd47f8ca9 in resettable_
#6 0x55abd47afdbd in bus_reset_
#7 0x55abd47fdac3 in resettable_
#8 0x55abd47f8685 in resettable_
#9 0x55abd47ec5f8 in device_
#10 0x55abd47fdac3 in resettable_
#11 0x55abd47f8685 in resettable_
#12 0x55abd47afdbd in bus_reset_
#13 0x55abd47fdac3 in resettable_
#14 0x55abd47f8685 in resettable_
#15 0x55abd47ec5f8 in device_
#16 0x55abd47fdac3 in resettable_
#17 0x55abd47f8685 in resettable_
#18 0x55abd47afdbd in bus_reset_
#19 0x55abd47fdac3 in resettable_
#20 0x55abd47f8685 in resettable_
#21 0x55abd47f6b28 in resettable_
#22 0x55abd47f68cf in resettable_reset /home/alxndr/
#23 0x55abd47fb779 in resettable_
#24 0x55abd47f67e5 in qemu_devices_reset /home/alxndr/
#25 0x55abd35a5c1e in pc_machine_reset /home/alxndr/
#26 0x55abd3d52d9e in qemu_system_reset /home/alxndr/
#27 0x55abd3d67d2e in qemu_init /home/alxndr/
#28 0x55abd16df677 in main /home/alxndr/
#29 0x7fd5d4ec0cc9 in __libc_start_main csu/../
SUMMARY: AddressSanitizer: heap-buffer-
-Alex
| description: | updated |
| Philippe Mathieu-Daudé (philmd) wrote | #1 |
| Philippe Mathieu-Daudé (philmd) wrote | #2 |
| Changed in qemu: | |
| status: | New → Fix Committed |
| Thomas Huth (th-huth) wrote | #3 |
| Changed in qemu: | |
| status: | Fix Committed → Fix Released |
Tentative fix:
https:/