Hi Mauro,
Oops... I missed that it was a stack-overflow. I went through my list of crashes, and the closest one I can find is a heap UAF, but it is a write, rather than a read:
/*
* Autogenerated Fuzzer Test Case
*
* Copyright (c) 2021 <name of author>
*
* This work is licensed under the terms of the GNU GPL, version 2 or
* later. See the COPYING file in the top-level directory.
*/
Hi Mauro,
Oops... I missed that it was a stack-overflow. I went through my list of crashes, and the closest one I can find is a heap UAF, but it is a write, rather than a read:
/*
* Autogenerated Fuzzer Test Case
*
* Copyright (c) 2021 <name of author>
*
* This work is licensed under the terms of the GNU GPL, version 2 or
* later. See the COPYING file in the top-level directory.
*/
#include "qemu/osdep.h"
#include "libqos/libqtest.h"
/* if=none, file=null- co://,format= raw -nodefaults -qtest stdio
"scsi- hd,drive= disk0 -drive "
"id=disk0, if=none, file=null- co://,format= raw -nodefaults"); bufwrite( s, 0x0, "\x41", 0x1);
* cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, \
* -m 4G -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
* id=disk0,
* outl 0xcf8 0x80001010
* outl 0xcfc 0xc000
* outl 0xcf8 0x80001004
* outw 0xcfc 0x05
* outb 0xc046 0x02
* outl 0xc00b 0xc100
* outl 0xc040 0x03
* outl 0xc040 0x03
* write 0x0 0x1 0x41
* outl 0xc00b 0xc100
* outw 0xc040 0x02
* outl 0xc00b 0x9000
* EOF
*/
static void test_fuzz(void)
{
QTestState *s = qtest_init(
"-display none , -m 4G -device am53c974,id=scsi -device "
qtest_outl(s, 0xcf8, 0x80001010);
qtest_outl(s, 0xcfc, 0xc000);
qtest_outl(s, 0xcf8, 0x80001004);
qtest_outw(s, 0xcfc, 0x05);
qtest_outb(s, 0xc046, 0x02);
qtest_outl(s, 0xc00b, 0xc100);
qtest_outl(s, 0xc040, 0x03);
qtest_outl(s, 0xc040, 0x03);
qtest_
qtest_outl(s, 0xc00b, 0xc100);
qtest_outw(s, 0xc040, 0x02);
qtest_outl(s, 0xc00b, 0x9000);
qtest_quit(s);
}
int main(int argc, char **argv)
{
const char *arch = qtest_get_arch();
g_test_ init(&argc, &argv, NULL);
if (strcmp(arch, "i386") == 0) {
qtest_ add_func( "fuzz/test_ fuzz", test_fuzz);
}
return g_test_run();
}