diff options
Diffstat (limited to 'results/classifier/deepseek-2-tmp/output/manual-review/1878259')
| -rw-r--r-- | results/classifier/deepseek-2-tmp/output/manual-review/1878259 | 55 |
1 files changed, 0 insertions, 55 deletions
diff --git a/results/classifier/deepseek-2-tmp/output/manual-review/1878259 b/results/classifier/deepseek-2-tmp/output/manual-review/1878259 deleted file mode 100644 index ad76d8d4b..000000000 --- a/results/classifier/deepseek-2-tmp/output/manual-review/1878259 +++ /dev/null @@ -1,55 +0,0 @@ - -Null-pointer dereference in megasas_handle_frame - -Hello, -While fuzzing, I found an input that triggers a null-pointer dereference in megasas_handle_frame: - -==1595==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55e3e83e6e08 bp 0x7ffdb04c63b0 sp 0x7ffd -==1595==The signal is caused by a READ memory access. -==1595==Hint: address points to the zero page. - #0 0x55e3e83e6e08 in megasas_handle_frame /home/alxndr/Development/qemu/hw/scsi/megasas.c:1952:36 - #1 0x55e3e83e6e08 in megasas_mmio_write /home/alxndr/Development/qemu/hw/scsi/megasas.c:2122:9 - #2 0x55e3e7d088d6 in memory_region_write_accessor /home/alxndr/Development/qemu/memory.c:483:5 - #3 0x55e3e7d0827f in access_with_adjusted_size /home/alxndr/Development/qemu/memory.c:544:18 - #4 0x55e3e7d0827f in memory_region_dispatch_write /home/alxndr/Development/qemu/memory.c:1476:16 - #5 0x55e3e7c1d1d3 in flatview_write_continue /home/alxndr/Development/qemu/exec.c:3137:23 - #6 0x55e3e7c15b97 in flatview_write /home/alxndr/Development/qemu/exec.c:3177:14 - #7 0x55e3e7c15b97 in address_space_write /home/alxndr/Development/qemu/exec.c:3268:18 - #8 0x55e3e7d03bc4 in qtest_process_command /home/alxndr/Development/qemu/qtest.c:567:9 - #9 0x55e3e7cfe74d in qtest_process_inbuf /home/alxndr/Development/qemu/qtest.c:710:9 - #10 0x55e3e8804cad in fd_chr_read /home/alxndr/Development/qemu/chardev/char-fd.c:68:9 - #11 0x7f602ef2a897 in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4e897) - #12 0x55e3e8948384 in glib_pollfds_poll /home/alxndr/Development/qemu/util/main-loop.c:219:9 - #13 0x55e3e8948384 in os_host_main_loop_wait /home/alxndr/Development/qemu/util/main-loop.c:242:5 - #14 0x55e3e8948384 in main_loop_wait /home/alxndr/Development/qemu/util/main-loop.c:518:11 - #15 0x55e3e7f27676 in qemu_main_loop /home/alxndr/Development/qemu/softmmu/vl.c:1664:9 - #16 0x55e3e8851c6a in main /home/alxndr/Development/qemu/softmmu/main.c:49:5 - #17 0x7f602dadae0a in __libc_start_main /build/glibc-GwnBeO/glibc-2.30/csu/../csu/libc-start.c:308:16 - #18 0x55e3e7b5c7b9 in _start (/home/alxndr/Development/qemu/build/i386-softmmu/qemu-system-i386+0x9027b9) - -I can reproduce it in qemu 5.0 using: - -cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -qtest stdio -nographic -monitor none -serial none -M q35 -device megasas -outl 0xcf8 0x80001814 -outl 0xcfc 0xc021 -outl 0xcf8 0x80001818 -outl 0xcf8 0x80001804 -outw 0xcfc 0x7 -outl 0xcf8 0x80001810 -outl 0xcfc 0xe10c0000 -outl 0xcf8 0x8000f810 -outl 0xcf8 0x8000fa24 -outl 0xcfc 0xe10c4000 -outl 0xcf8 0x8000fa04 -outw 0xcfc 0x7 -outl 0xcf8 0x8000fb20 -write 0xe10c4384 0x15 0x838383838383838383838383838383838383838383 -write 0xc021e10c00c0 0x4 0x082c04dd -EOF - -I also attached the commands to this launchpad report, in case the formatting is broken: - -qemu-system-i386 -qtest stdio -nographic -monitor none -serial none -M q35 -device megasas < attachment - -Please let me know if I can provide any further info. --Alex \ No newline at end of file |