Re: [Xen-devel] [PATCH v2] fuzz/x86_emulate: fix bounds for input size

2018-03-02 Thread Wei Liu
On Mon, Feb 26, 2018 at 10:33:40AM +, Wei Liu wrote: > On Fri, Feb 23, 2018 at 11:48:57PM +0100, Paul Semel wrote: > > The maximum size for the input size was set to INPUT_SIZE, which is actually > > the size of the data array inside the fuzz_corpus structure and so was not > > abling user (or

Re: [Xen-devel] [PATCH v2] fuzz/x86_emulate: fix bounds for input size

2018-02-28 Thread Paul Semel
Hey George, On 02/27/2018 11:39 AM, George Dunlap wrote: Thanks for the patch. Looking a bit more at the code over the weekend, I figured out what that BUILD_BUG_ON() is for -- in afl_harness.c, we statically allocate a buffer of size INPUT_SIZE to hold the fuzz data. The BUILD_BUG_ON() is to ma

Re: [Xen-devel] [PATCH v2] fuzz/x86_emulate: fix bounds for input size

2018-02-27 Thread George Dunlap
On 02/23/2018 10:48 PM, Paul Semel wrote: > The maximum size for the input size was set to INPUT_SIZE, which is actually > the size of the data array inside the fuzz_corpus structure and so was not > abling user (or AFL) to fill in the whole structure. Changing to > sizeof(struct fuzz_corpus) corre

Re: [Xen-devel] [PATCH v2] fuzz/x86_emulate: fix bounds for input size

2018-02-26 Thread Wei Liu
On Fri, Feb 23, 2018 at 11:48:57PM +0100, Paul Semel wrote: > The maximum size for the input size was set to INPUT_SIZE, which is actually > the size of the data array inside the fuzz_corpus structure and so was not > abling user (or AFL) to fill in the whole structure. Changing to > sizeof(struct

[Xen-devel] [PATCH v2] fuzz/x86_emulate: fix bounds for input size

2018-02-23 Thread Paul Semel
The maximum size for the input size was set to INPUT_SIZE, which is actually the size of the data array inside the fuzz_corpus structure and so was not abling user (or AFL) to fill in the whole structure. Changing to sizeof(struct fuzz_corpus) correct this problem. Signed-off-by: Paul Semel ---