blob: 8e795c3bd84af46678ae915f8686112f2b32fee1 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
|
id = 1926
title = "Spice: handle_dev_destroy_surface_wait: condition `msg->surface_id == 0' failed (DoS via assert failure)"
state = "closed"
created_at = "2023-10-09T11:52:41.324Z"
closed_at = "2025-01-13T09:42:59.989Z"
labels = ["Fuzzer", "host: x86", "spice", "target: i386"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/1926"
host-os = "Debian 12"
host-arch = "x86_64"
qemu-version = "version 8.1.50 (v8.1.0-1353-g 2f3913f4b2-dirty), commit 2f3913f4b2"
guest-os = "n/a"
guest-arch = "n/a"
description = """Assert failure in libspice-server was found during fuzzing qxl-vga device.
```plaintext
qemu-system-x86_64: Spice: ../server/red-worker.cpp:367:handle_dev_destroy_surface_wait: condition `msg->surface_id == 0' failed
Аварийный останов
```"""
reproduce = """1. This bug can be reroduced with
```plaintext
cat << EOF | ./qemu-system-x86_64 -display none -machine accel=qtest, -m 512M -M \\
pc -nodefaults -vga qxl -qtest stdio
outl 0xcf8 0x8000101c
outl 0xcfc 0xc000
outl 0xcf8 0x80001004
outw 0xcfc 0x01
outl 0xc00b 0x01000000
EOF
```
2. This bug is in another place from https://gitlab.com/qemu-project/qemu/-/issues/1829, please pay attention to it. It has to be solved, because it interferes with further fuzzing process"""
additional = """As I mentioned, I really need this bug to be solved, because fuzzing qxl-vga device gets less efficient. I suggested to report it here, not in spice-server, because this bug can be on the QEMU side."""
|