add 18th iteration of classifier

1 files changed, 97 insertions, 0 deletions

diff --git a/results/classifier/118/none/2740 b/results/classifier/118/none/2740
new file mode 100644
index 00000000..9a38065a
--- /dev/null
+++ b/results/classifier/118/none/2740
@@ -0,0 +1,97 @@
+risc-v: 0.669
+user-level: 0.666
+TCG: 0.616
+mistranslation: 0.612
+hypervisor: 0.604
+vnc: 0.589
+virtual: 0.582
+ppc: 0.563
+register: 0.560
+VMM: 0.558
+x86: 0.553
+debug: 0.553
+network: 0.547
+arm: 0.546
+device: 0.542
+KVM: 0.542
+peripherals: 0.541
+permissions: 0.527
+architecture: 0.525
+assembly: 0.520
+PID: 0.517
+graphic: 0.515
+boot: 0.514
+performance: 0.513
+semantic: 0.509
+kernel: 0.498
+socket: 0.460
+files: 0.437
+i386: 0.418
+
+Out-of-bounds access and heap-use-after-free in smc91c111_writeb()
+Description of problem:
+An out-of-bounds access bug was triggered by my fuzzer.
+
+The error is:
+
+```
+../hw/net/smc91c111.c:457:17: runtime error: index 48 out of bounds for type 'uint8_t[4][2048]' (aka 'unsigned char[4][2048]')
+SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/net/smc91c111.c:457:17 in
+=================================================================
+==60006==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290000385b4 at pc 0x5de3d1ac6add bp 0x7ffc4d4b2b30 sp 0x7ffc4d4b2b28
+WRITE of size 1 at 0x6290000385b4 thread T0
+warning: DWARF unit at offset 0x00417a37 has unsupported address size: 31 (supported are 2, 4, 8)
+    #0 0x5de3d1ac6adc in smc91c111_writeb smc91c111.c
+    #1 0x5de3d1abf6e3 in smc91c111_writefn smc91c111.c
+    #2 0x5de3d2d9e2d3 in memory_region_write_accessor memory.c
+    #3 0x5de3d2d9da4a in access_with_adjusted_size memory.c
+    #4 0x5de3d2d9ce78 in memory_region_dispatch_write
+    #5 0x5de3d2df5e44 in flatview_write_continue_step physmem.c
+    #6 0x5de3d2de2d40 in flatview_write physmem.c
+    #7 0x5de3d2de29d7 in address_space_write
+    ...
+
+0x6290000385b4 is located 5044 bytes inside of 16176-byte region [0x629000037200,0x62900003b130)
+freed by thread T0 here:
+    #0 0x5de3d1100027 in __interceptor_free.part.0 asan_malloc_linux.cpp
+    #1 0x5de3d2f35106 in object_unref
+    #2 0x5de3d24ac45c in qemu_get_nic_models
+    #3 0x5de3d24acead in qemu_create_nic_bus_devices
+    #4 0x5de3d2722553 in realview_init realview.c
+    #5 0x5de3d1468182 in machine_run_board_init
+    #6 0x5de3d237e40a in qmp_x_exit_preconfig
+    #7 0x5de3d238505c in qemu_init
+    ...
+
+previously allocated by thread T0 here:
+    #0 0x5de3d1101217 in malloc
+    #1 0x7ea39d40a738 in g_malloc
+    #2 0x5de3d24acead in qemu_create_nic_bus_devices
+    #3 0x5de3d2722553 in realview_init realview.c
+    #4 0x5de3d1468182 in machine_run_board_init
+    #5 0x5de3d237e40a in qmp_x_exit_preconfig
+    #6 0x5de3d238505c in qemu_init
+    ...
+```
+Steps to reproduce:
+```
+export QEMU_ARGS="-display none -machine accel=qtest, -m 512M -machine realview-eb"
+cat << EOF | ./qemu-system-arm $QEMU_ARGS -qtest /dev/null -qtest stdio
+clock_step
+readw 0x4e000000
+readw 0x4e000000
+clock_step
+writel 0x4e00000c 0x2402e660
+readb 0x4e000008
+readl 0x4e000000
+clock_step
+readb 0x4e000000
+writel 0x4e000000 0x66308c81
+writew 0x4e000008 0xe40ba4c
+readb 0x4e000000
+readw 0x4e000000
+readl 0x4e000008
+EOF
+```
+Additional information:
+