[Bug 1917085] Re: [OSS-Fuzz] Issue 30588 pcnet: Loopback-related stack-overflow

[Alexander Bulekov]

OSS-Fuzz says this has been fixed

** Changed in: qemu
       Status: New => Fix Committed

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1917085

Title:
   [OSS-Fuzz] Issue 30588 pcnet: Loopback-related stack-overflow

Status in QEMU:
  Fix Committed

Bug description:
  === Reproducer ===
  cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
  512M -machine q35 -nodefaults -device pcnet,netdev=net0 -netdev \
  user,id=net0 -qtest /dev/null -qtest stdio
  outl 0xcf8 0x80000810
  outl 0xcfc 0xc001
  outl 0xcf8 0x80000804
  outw 0xcfc 0x7
  outl 0xc011 0xff14ff
  outl 0xcf8 0x80000815
  outl 0xcfc 0xffffffff
  outl 0xc015 0x35a
  inl 0xc012
  outw 0xc010 0x6165
  outw 0xc010 0x1127
  write 0x0 0x1 0x56
  write 0x2 0x1 0xff
  write 0x15 0x1 0xff
  write 0x16 0x1 0xff
  write 0x17 0x1 0xff
  write 0x18 0x1 0xfd
  write 0x19 0x1 0x59
  write 0x1a 0x1 0xfe
  write 0x1b 0x1 0xff
  outw 0xc010 0x1db
  EOF

  === Stack-trace ===
  ==312573==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd5bb4cec8 
(pc 0x55a8f1c9cf36 bp 0x7ffd5bb4d710 sp 0x7ffd5bb4ced0 T0)
  #0 0x55a8f1c9cf36 in __asan_memcpy 
(/home/alxndr/Development/qemu/build/qemu-system-i386+0x2baff36)
  #1 0x55a8f2f54ddf in flatview_do_translate 
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:518:12
  #2 0x55a8f2f6ec8e in flatview_translate 
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:568:15
  #3 0x55a8f2f6ec8e in flatview_read 
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2878:10
  #4 0x55a8f2f6ec8e in address_space_read_full 
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2892:18
  #5 0x55a8f273036e in pcnet_rmd_load 
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:381:9
  #6 0x55a8f272e386 in pcnet_rdte_poll 
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:896:9
  #7 0x55a8f27299d0 in pcnet_receive 
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1016:9
  #8 0x55a8f27406be in pcnet_transmit 
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1253:13
  #9 0x55a8f2735b4c in pcnet_poll_timer 
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1322:9
  #10 0x55a8f273c353 in pcnet_ioport_readl 
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1660:5
  #11 0x55a8f2727361 in pcnet_ioport_read 
/home/alxndr/Development/qemu/build/../hw/net/pcnet-pci.c:107:20
  #12 0x55a8f309e9f6 in memory_region_read_accessor 
/home/alxndr/Development/qemu/build/../softmmu/memory.c:442:11
  #13 0x55a8f3070d63 in access_with_adjusted_size 
/home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18
  #14 0x55a8f306f222 in memory_region_dispatch_read1 
/home/alxndr/Development/qemu/build/../softmmu/memory.c
  #15 0x55a8f306f222 in memory_region_dispatch_read 
/home/alxndr/Development/qemu/build/../softmmu/memory.c:1449:9
  #16 0x55a8f2f6d88f in flatview_read_continue 
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2839:23
  #17 0x55a8f2f6ed1b in flatview_read 
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2879:12
  #18 0x55a8f2f6ed1b in address_space_read_full 
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2892:18
  #19 0x55a8f273036e in pcnet_rmd_load 
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:381:9
  #20 0x55a8f2729d97 in pcnet_receive 
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1028:17
  #21 0x55a8f27406be in pcnet_transmit 
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1253:13
  #22 0x55a8f2735b4c in pcnet_poll_timer 
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1322:9
  #23 0x55a8f273c353 in pcnet_ioport_readl 
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1660:5
  #24 0x55a8f2727361 in pcnet_ioport_read 
/home/alxndr/Development/qemu/build/../hw/net/pcnet-pci.c:107:20
  #25 0x55a8f309e9f6 in memory_region_read_accessor 
/home/alxndr/Development/qemu/build/../softmmu/memory.c:442:11
  #26 0x55a8f3070d63 in access_with_adjusted_size 
/home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18
  #27 0x55a8f306f222 in memory_region_dispatch_read1 
/home/alxndr/Development/qemu/build/../softmmu/memory.c
  #28 0x55a8f306f222 in memory_region_dispatch_read 
/home/alxndr/Development/qemu/build/../softmmu/memory.c:1449:9
  #29 0x55a8f2f6d88f in flatview_read_continue 
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2839:23
  #30 0x55a8f2f6ed1b in flatview_read 
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2879:12

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1917085/+subscriptions