diff options
| author | Christian Krinitsin <mail@krinitsin.com> | 2025-07-03 07:27:52 +0000 |
|---|---|---|
| committer | Christian Krinitsin <mail@krinitsin.com> | 2025-07-03 07:27:52 +0000 |
| commit | d0c85e36e4de67af628d54e9ab577cc3fad7796a (patch) | |
| tree | f8f784b0f04343b90516a338d6df81df3a85dfa2 /results/classifier/deepseek-2-tmp/output/device/786208 | |
| parent | 7f4364274750eb8cb39a3e7493132fca1c01232e (diff) | |
| download | emulator-bug-study-d0c85e36e4de67af628d54e9ab577cc3fad7796a.tar.gz emulator-bug-study-d0c85e36e4de67af628d54e9ab577cc3fad7796a.zip | |
add deepseek and gemma results
Diffstat (limited to 'results/classifier/deepseek-2-tmp/output/device/786208')
| -rw-r--r-- | results/classifier/deepseek-2-tmp/output/device/786208 | 10 |
1 files changed, 0 insertions, 10 deletions
diff --git a/results/classifier/deepseek-2-tmp/output/device/786208 b/results/classifier/deepseek-2-tmp/output/device/786208 deleted file mode 100644 index c9f96e5e..00000000 --- a/results/classifier/deepseek-2-tmp/output/device/786208 +++ /dev/null @@ -1,10 +0,0 @@ - -Missing checks for non-existent device in ide_exec_cmd - -Several calls in the ide_exec_cmd handler are missing checks for (!s->bs) or similar, resulting in NULL pointer dereferences, divide-by-zero, or possibly other badness if the guest performs operations on a non-existent IDE master. - -For example, the WIN_READ_NATIVE_MAX command does a 'ide_set_sector(s, s->nb_sectors - 1);', which does 'cyl = sector_num / (s->heads * s->sectors);', which will fail with a divide-by-zero if heads = sectors = 0. - -And WIN_MULTREAD also does not check for s->bs, but does a 'ide_sector_read(s);', which will do 'bdrv_read(s->bs, sector_num, s->io_buffer, n);' on a NULL s->bs, leading to a segfault. - -I do not *believe* that a malicious guest can do anything more than cause a crash with these bugs.
\ No newline at end of file |