https://gitlab.com/qemu-project/qemu/-/commit/99ccfaa1edafd79f7a3a0ff7
** Changed in: qemu
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1917085
Title:
[OSS-Fuzz] Issue 30588 pcnet: Loopback-related stack-overflow
Status in QEMU:
Fix Released
Bug description:
=== Reproducer ===
cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
512M -machine q35 -nodefaults -device pcnet,netdev=net0 -netdev \
user,id=net0 -qtest /dev/null -qtest stdio
outl 0xcf8 0x80000810
outl 0xcfc 0xc001
outl 0xcf8 0x80000804
outw 0xcfc 0x7
outl 0xc011 0xff14ff
outl 0xcf8 0x80000815
outl 0xcfc 0xffffffff
outl 0xc015 0x35a
inl 0xc012
outw 0xc010 0x6165
outw 0xc010 0x1127
write 0x0 0x1 0x56
write 0x2 0x1 0xff
write 0x15 0x1 0xff
write 0x16 0x1 0xff
write 0x17 0x1 0xff
write 0x18 0x1 0xfd
write 0x19 0x1 0x59
write 0x1a 0x1 0xfe
write 0x1b 0x1 0xff
outw 0xc010 0x1db
EOF
=== Stack-trace ===
==312573==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd5bb4cec8
(pc 0x55a8f1c9cf36 bp 0x7ffd5bb4d710 sp 0x7ffd5bb4ced0 T0)
#0 0x55a8f1c9cf36 in __asan_memcpy
(/home/alxndr/Development/qemu/build/qemu-system-i386+0x2baff36)
#1 0x55a8f2f54ddf in flatview_do_translate
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:518:12
#2 0x55a8f2f6ec8e in flatview_translate
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:568:15
#3 0x55a8f2f6ec8e in flatview_read
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2878:10
#4 0x55a8f2f6ec8e in address_space_read_full
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2892:18
#5 0x55a8f273036e in pcnet_rmd_load
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:381:9
#6 0x55a8f272e386 in pcnet_rdte_poll
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:896:9
#7 0x55a8f27299d0 in pcnet_receive
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1016:9
#8 0x55a8f27406be in pcnet_transmit
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1253:13
#9 0x55a8f2735b4c in pcnet_poll_timer
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1322:9
#10 0x55a8f273c353 in pcnet_ioport_readl
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1660:5
#11 0x55a8f2727361 in pcnet_ioport_read
/home/alxndr/Development/qemu/build/../hw/net/pcnet-pci.c:107:20
#12 0x55a8f309e9f6 in memory_region_read_accessor
/home/alxndr/Development/qemu/build/../softmmu/memory.c:442:11
#13 0x55a8f3070d63 in access_with_adjusted_size
/home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18
#14 0x55a8f306f222 in memory_region_dispatch_read1
/home/alxndr/Development/qemu/build/../softmmu/memory.c
#15 0x55a8f306f222 in memory_region_dispatch_read
/home/alxndr/Development/qemu/build/../softmmu/memory.c:1449:9
#16 0x55a8f2f6d88f in flatview_read_continue
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2839:23
#17 0x55a8f2f6ed1b in flatview_read
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2879:12
#18 0x55a8f2f6ed1b in address_space_read_full
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2892:18
#19 0x55a8f273036e in pcnet_rmd_load
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:381:9
#20 0x55a8f2729d97 in pcnet_receive
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1028:17
#21 0x55a8f27406be in pcnet_transmit
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1253:13
#22 0x55a8f2735b4c in pcnet_poll_timer
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1322:9
#23 0x55a8f273c353 in pcnet_ioport_readl
/home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1660:5
#24 0x55a8f2727361 in pcnet_ioport_read
/home/alxndr/Development/qemu/build/../hw/net/pcnet-pci.c:107:20
#25 0x55a8f309e9f6 in memory_region_read_accessor
/home/alxndr/Development/qemu/build/../softmmu/memory.c:442:11
#26 0x55a8f3070d63 in access_with_adjusted_size
/home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18
#27 0x55a8f306f222 in memory_region_dispatch_read1
/home/alxndr/Development/qemu/build/../softmmu/memory.c
#28 0x55a8f306f222 in memory_region_dispatch_read
/home/alxndr/Development/qemu/build/../softmmu/memory.c:1449:9
#29 0x55a8f2f6d88f in flatview_read_continue
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2839:23
#30 0x55a8f2f6ed1b in flatview_read
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2879:12
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1917085/+subscriptions
