diff options
Diffstat (limited to 'results/classifier/zero-shot/118/unknown/1913919')
| -rw-r--r-- | results/classifier/zero-shot/118/unknown/1913919 | 188 |
1 files changed, 188 insertions, 0 deletions
diff --git a/results/classifier/zero-shot/118/unknown/1913919 b/results/classifier/zero-shot/118/unknown/1913919 new file mode 100644 index 00000000..db5f3eed --- /dev/null +++ b/results/classifier/zero-shot/118/unknown/1913919 @@ -0,0 +1,188 @@ +virtual: 0.928 +graphic: 0.902 +hypervisor: 0.890 +user-level: 0.883 +performance: 0.883 +semantic: 0.881 +register: 0.881 +mistranslation: 0.881 +architecture: 0.860 +peripherals: 0.859 +debug: 0.859 +arm: 0.858 +permissions: 0.858 +risc-v: 0.851 +files: 0.847 +device: 0.844 +assembly: 0.833 +TCG: 0.829 +boot: 0.827 +vnc: 0.824 +socket: 0.823 +x86: 0.819 +PID: 0.819 +kernel: 0.814 +KVM: 0.807 +ppc: 0.800 +i386: 0.799 +VMM: 0.796 +network: 0.785 + +Heap-buffer-overflow in sdhci_write_dataport + +Reproducer: +cat << EOF | ./qemu-system-aarch64 -qtest stdio \ +-machine raspi3b,accel=qtest -m 1G +write 0x3f30002c 0x1 0x25 +write 0x3f300004 0x1 0x01 +write 0x3f300006 0x1 0xc0 +write 0x3f30000c 0x1 0x22 +write 0x3f30000e 0x1 0x20 +write 0x3f30000f 0x1 0x0 +write 0x3f300000 0x1 0x48 +write 0x3f300003 0x1 0x0 +write 0x3f300005 0x1 0x14 +write 0x3f300007 0x1 0x10 +write 0x3f30000c 0x1 0x32 +write 0x3f30000f 0x1 0x0 +write 0x3f300001 0x1 0x00 +write 0x3f300002 0x1 0x30 +write 0x3f300003 0x1 0x3f +EOF + +Stacktrace: +==654080==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000017b80 at pc 0x562988348719 bp 0x7fffd26552d0 sp 0x7fffd26552c8 +WRITE of size 1 at 0x619000017b80 thread T0 + #0 0x562988348718 in sdhci_write_dataport /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:560:39 + #1 0x562988348718 in sdhci_write /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1172:13 + #2 0x5629890591fe in memory_region_write_accessor /home/alxndr/Development/qemu/build/../softmmu/memory.c:491:5 + #3 0x562989058bfb in access_with_adjusted_size /home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18 + #4 0x562989058467 in memory_region_dispatch_write /home/alxndr/Development/qemu/build/../softmmu/memory.c + #5 0x5629893e8ffb in flatview_write_continue /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2759:23 + #6 0x5629893de71b in flatview_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2799:14 + #7 0x5629893de71b in address_space_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2891:18 + #8 0x562988334d9c in dma_memory_rw_relaxed /home/alxndr/Development/qemu/include/sysemu/dma.h:88:12 + #9 0x562988334d9c in dma_memory_rw /home/alxndr/Development/qemu/include/sysemu/dma.h:127:12 + #10 0x562988334d9c in dma_memory_write /home/alxndr/Development/qemu/include/sysemu/dma.h:163:12 + #11 0x562988334d9c in sdhci_sdma_transfer_multi_blocks /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:617:13 + #12 0x56298834427f in sdhci_write /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1129:17 + #13 0x5629890591fe in memory_region_write_accessor /home/alxndr/Development/qemu/build/../softmmu/memory.c:491:5 + #14 0x562989058bfb in access_with_adjusted_size /home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18 + #15 0x562989058467 in memory_region_dispatch_write /home/alxndr/Development/qemu/build/../softmmu/memory.c + #16 0x5629893e8ffb in flatview_write_continue /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2759:23 + #17 0x5629893de71b in flatview_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2799:14 + #18 0x5629893de71b in address_space_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2891:18 + #19 0x56298904ad35 in qtest_process_command /home/alxndr/Development/qemu/build/../softmmu/qtest.c:654:9 + #20 0x562989043b97 in qtest_process_inbuf /home/alxndr/Development/qemu/build/../softmmu/qtest.c:797:9 + #21 0x562989894286 in fd_chr_read /home/alxndr/Development/qemu/build/../chardev/char-fd.c:68:9 + #22 0x7f535645baae in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51aae) + #23 0x562989eef363 in glib_pollfds_poll /home/alxndr/Development/qemu/build/../util/main-loop.c:232:9 + #24 0x562989eef363 in os_host_main_loop_wait /home/alxndr/Development/qemu/build/../util/main-loop.c:255:5 + #25 0x562989eef363 in main_loop_wait /home/alxndr/Development/qemu/build/../util/main-loop.c:531:11 + #26 0x562988faa599 in qemu_main_loop /home/alxndr/Development/qemu/build/../softmmu/runstate.c:721:9 + #27 0x5629872371fd in main /home/alxndr/Development/qemu/build/../softmmu/main.c:50:5 + #28 0x7f5355f00cc9 in __libc_start_main csu/../csu/libc-start.c:308:16 + #29 0x56298718abc9 in _start (/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x3350bc9) + +0x619000017b80 is located 0 bytes to the right of 1024-byte region [0x619000017780,0x619000017b80) +allocated by thread T0 here: + #0 0x562987204db2 in calloc (/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x33cadb2) + #1 0x7f5356461ae0 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ae0) + #2 0x56298834a187 in sdhci_sysbus_realize /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1469:5 + #3 0x56298987fe77 in device_set_realized /home/alxndr/Development/qemu/build/../hw/core/qdev.c:761:13 + #4 0x5629898153b5 in property_set_bool /home/alxndr/Development/qemu/build/../qom/object.c:2255:5 + +Can you still reproduce this issue with the latest git version of QEMU? ... for me, it does not crash anymore. + +There were a few patches some months ago that fixed the sdhci issues, +and OSS-Fuzz said that all of the heap-overflows that it has seen in +sdhci have been fixed. +-Alex + +On 210610 1544, Thomas Huth wrote: +> Can you still reproduce this issue with the latest git version of QEMU? +> ... for me, it does not crash anymore. +> +> ** Changed in: qemu +> Status: New => Incomplete +> +> -- +> You received this bug notification because you are subscribed to the bug +> report. +> https://bugs.launchpad.net/bugs/1913919 +> +> Title: +> Heap-buffer-overflow in sdhci_write_dataport +> +> Status in QEMU: +> Incomplete +> +> Bug description: +> Reproducer: +> cat << EOF | ./qemu-system-aarch64 -qtest stdio \ +> -machine raspi3b,accel=qtest -m 1G +> write 0x3f30002c 0x1 0x25 +> write 0x3f300004 0x1 0x01 +> write 0x3f300006 0x1 0xc0 +> write 0x3f30000c 0x1 0x22 +> write 0x3f30000e 0x1 0x20 +> write 0x3f30000f 0x1 0x0 +> write 0x3f300000 0x1 0x48 +> write 0x3f300003 0x1 0x0 +> write 0x3f300005 0x1 0x14 +> write 0x3f300007 0x1 0x10 +> write 0x3f30000c 0x1 0x32 +> write 0x3f30000f 0x1 0x0 +> write 0x3f300001 0x1 0x00 +> write 0x3f300002 0x1 0x30 +> write 0x3f300003 0x1 0x3f +> EOF +> +> Stacktrace: +> ==654080==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000017b80 at pc 0x562988348719 bp 0x7fffd26552d0 sp 0x7fffd26552c8 +> WRITE of size 1 at 0x619000017b80 thread T0 +> #0 0x562988348718 in sdhci_write_dataport /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:560:39 +> #1 0x562988348718 in sdhci_write /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1172:13 +> #2 0x5629890591fe in memory_region_write_accessor /home/alxndr/Development/qemu/build/../softmmu/memory.c:491:5 +> #3 0x562989058bfb in access_with_adjusted_size /home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18 +> #4 0x562989058467 in memory_region_dispatch_write /home/alxndr/Development/qemu/build/../softmmu/memory.c +> #5 0x5629893e8ffb in flatview_write_continue /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2759:23 +> #6 0x5629893de71b in flatview_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2799:14 +> #7 0x5629893de71b in address_space_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2891:18 +> #8 0x562988334d9c in dma_memory_rw_relaxed /home/alxndr/Development/qemu/include/sysemu/dma.h:88:12 +> #9 0x562988334d9c in dma_memory_rw /home/alxndr/Development/qemu/include/sysemu/dma.h:127:12 +> #10 0x562988334d9c in dma_memory_write /home/alxndr/Development/qemu/include/sysemu/dma.h:163:12 +> #11 0x562988334d9c in sdhci_sdma_transfer_multi_blocks /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:617:13 +> #12 0x56298834427f in sdhci_write /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1129:17 +> #13 0x5629890591fe in memory_region_write_accessor /home/alxndr/Development/qemu/build/../softmmu/memory.c:491:5 +> #14 0x562989058bfb in access_with_adjusted_size /home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18 +> #15 0x562989058467 in memory_region_dispatch_write /home/alxndr/Development/qemu/build/../softmmu/memory.c +> #16 0x5629893e8ffb in flatview_write_continue /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2759:23 +> #17 0x5629893de71b in flatview_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2799:14 +> #18 0x5629893de71b in address_space_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2891:18 +> #19 0x56298904ad35 in qtest_process_command /home/alxndr/Development/qemu/build/../softmmu/qtest.c:654:9 +> #20 0x562989043b97 in qtest_process_inbuf /home/alxndr/Development/qemu/build/../softmmu/qtest.c:797:9 +> #21 0x562989894286 in fd_chr_read /home/alxndr/Development/qemu/build/../chardev/char-fd.c:68:9 +> #22 0x7f535645baae in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51aae) +> #23 0x562989eef363 in glib_pollfds_poll /home/alxndr/Development/qemu/build/../util/main-loop.c:232:9 +> #24 0x562989eef363 in os_host_main_loop_wait /home/alxndr/Development/qemu/build/../util/main-loop.c:255:5 +> #25 0x562989eef363 in main_loop_wait /home/alxndr/Development/qemu/build/../util/main-loop.c:531:11 +> #26 0x562988faa599 in qemu_main_loop /home/alxndr/Development/qemu/build/../softmmu/runstate.c:721:9 +> #27 0x5629872371fd in main /home/alxndr/Development/qemu/build/../softmmu/main.c:50:5 +> #28 0x7f5355f00cc9 in __libc_start_main csu/../csu/libc-start.c:308:16 +> #29 0x56298718abc9 in _start (/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x3350bc9) +> +> 0x619000017b80 is located 0 bytes to the right of 1024-byte region [0x619000017780,0x619000017b80) +> allocated by thread T0 here: +> #0 0x562987204db2 in calloc (/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x33cadb2) +> #1 0x7f5356461ae0 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ae0) +> #2 0x56298834a187 in sdhci_sysbus_realize /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1469:5 +> #3 0x56298987fe77 in device_set_realized /home/alxndr/Development/qemu/build/../hw/core/qdev.c:761:13 +> #4 0x5629898153b5 in property_set_bool /home/alxndr/Development/qemu/build/../qom/object.c:2255:5 +> +> To manage notifications about this bug go to: +> https://bugs.launchpad.net/qemu/+bug/1913919/+subscriptions + + +Ok, thanks for confirmation, then let's close this ticket here. If you encounter such a problem again, please open a new ticket in the new gitlab issue tracker. + |