1 files changed, 63 insertions, 0 deletions

diff --git a/gitlab/issues/target_missing/host_missing/accel_missing/1254.toml b/gitlab/issues/target_missing/host_missing/accel_missing/1254.toml
new file mode 100644
index 00000000..791ea810
--- /dev/null
+++ b/gitlab/issues/target_missing/host_missing/accel_missing/1254.toml
@@ -0,0 +1,63 @@
+id = 1254
+title = "hw: misc: edu: two off-by-one errors"
+state = "closed"
+created_at = "2022-10-14T14:51:10.891Z"
+closed_at = "2024-04-30T22:57:05.020Z"
+labels = ["Fuzzer"]
+url = "https://gitlab.com/qemu-project/qemu/-/issues/1254"
+host-os = "irrelevant"
+host-arch = "irrelevant"
+qemu-version = "2ba341b3694cf3cff7b8a1df4cc765900d5c4f60"
+guest-os = "irrelevant"
+guest-arch = "irrelevant"
+description = """In `hw/misc/edu.c`, `edu_check_range()` fails for boundary conditions where `size2 == 0` and `size2 == size1`."""
+reproduce = """Two ways to reproduce (attached test program, [foo.c](/uploads/9cbef4f72d175b8336b58f607e262d7b/foo.c))
+
+error:
+1. `gcc -o foo foo.c`
+2. `./foo`
+
+fix:
+1. `gcc -DFIXED -o foo foo.c`
+2. `./foo`
+
+Using `qtest`: (see "QEMU command line" above)."""
+additional = """(output of `foo` without fix):
+```
+EDU: DMA range 0x0000000000000000-0x0000000000000fff out of bounds (0x0000000000000000-0xffffffffffffffff)!
+EDU: DMA range 0x0000000000000000-0x0000000000000fff out of bounds (0x0000000000000000-0x0000000000000fff)!
+```
+
+Output of `qtest` without the fix:
+```
+qemu: hardware error: EDU: DMA range 0x0000000000000000-0x0000000000000fff out of bounds (0x0000000000040000-0x0000000000040fff)!
+CPU #0:
+EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000663
+ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
+EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
+ES =0000 00000000 0000ffff 00009300
+CS =f000 ffff0000 0000ffff 00009b00
+SS =0000 00000000 0000ffff 00009300
+DS =0000 00000000 0000ffff 00009300
+FS =0000 00000000 0000ffff 00009300
+GS =0000 00000000 0000ffff 00009300
+LDT=0000 00000000 0000ffff 00008200
+TR =0000 00000000 0000ffff 00008b00
+GDT=     00000000 0000ffff
+IDT=     00000000 0000ffff
+CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
+DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000 
+DR6=ffff0ff0 DR7=00000400
+EFER=0000000000000000
+FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
+FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
+FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
+FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
+FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
+XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
+XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
+XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
+XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
+```
+
+Patch has been submitted to `qemu-devel`"""