a9f67c1d51
This code had all sorts of issues. We used a loop similar to address_space_write_rom, but I did not remove a "break" that only made sense in the context of the switch statement in the original code. Then, after the loop, we did a separate qtest_memwrite over the entire DMA access range, defeating the purpose of the loop. Additionally, we increment the buf pointer, and then try to g_free() it. Fix these problems. Reported-by: OSS-Fuzz (Issue 26725) Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: OSS-Fuzz (Issue 26691) Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-Id: <20201029172901.534442-2-alxndr@bu.edu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
||
|---|---|---|
| .. | ||
| fork_fuzz.c | ||
| fork_fuzz.h | ||
| fork_fuzz.ld | ||
| fuzz.c | ||
| fuzz.h | ||
| generic_fuzz.c | ||
| generic_fuzz_configs.h | ||
| i440fx_fuzz.c | ||
| meson.build | ||
| qos_fuzz.c | ||
| qos_fuzz.h | ||
| qtest_wrappers.c | ||
| virtio_net_fuzz.c | ||
| virtio_scsi_fuzz.c | ||