[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [Xen-devel] [PATCH 03/10] tools/insn-fuzz: Don't use memcpy() for zero-length reads
On 27/03/17 10:56, Andrew Cooper wrote: > For control-flow changes, the emulator needs to perform a zero-length > instruction fetch at the target offset. It also passes NULL for the > destination buffer, as there is no instruction stream to collect. > > This trips up UBSAN, even with a size of 0. Exclude zero-length reads from > using memcpy(), rather than excluding NULL destination pointers, to still > catch unintentional uses of NULL. So memcpy() will actually try to write to dst even if bytes == 0? That seems a bit strange, but OK: Acked-by: George Dunlap <george.dunlap@xxxxxxxxxx> > > Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> > --- > CC: Jan Beulich <JBeulich@xxxxxxxx> > CC: George Dunlap <george.dunlap@xxxxxxxxxxxxx> > CC: Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx> > CC: Wei Liu <wei.liu2@xxxxxxxxxx> > --- > tools/fuzz/x86_instruction_emulator/fuzz-emul.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/tools/fuzz/x86_instruction_emulator/fuzz-emul.c > b/tools/fuzz/x86_instruction_emulator/fuzz-emul.c > index 890642c..cbdb3dd 100644 > --- a/tools/fuzz/x86_instruction_emulator/fuzz-emul.c > +++ b/tools/fuzz/x86_instruction_emulator/fuzz-emul.c > @@ -77,7 +77,7 @@ static int data_read(const char *why, void *dst, unsigned > int bytes) > else > rc = maybe_fail(why, true); > > - if ( rc == X86EMUL_OKAY ) > + if ( rc == X86EMUL_OKAY && bytes ) > { > memcpy(dst, input.data + data_index, bytes); > data_index += bytes; > _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx https://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |