From 9d20f2af535a928a20eb4e5fcb782f9d43dae5ac Mon Sep 17 00:00:00 2001 From: Qiuhao Li Date: Mon, 11 Jan 2021 14:11:50 +0800 Subject: fuzz: set bits in operand of write/out to zero Simplifying the crash cases by opportunistically setting bits in operands of out/write to zero may help to debug, since usually bit one means turn on or trigger a function while zero is the default turn-off setting. Tested bug https://bugs.launchpad.net/qemu/+bug/1908062 Signed-off-by: Qiuhao Li Reviewed-by: Alexander Bulekov Tested-by: Alexander Bulekov Message-Id: Signed-off-by: Thomas Huth --- scripts/oss-fuzz/minimize_qtest_trace.py | 39 ++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) (limited to 'scripts/oss-fuzz') diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py b/scripts/oss-fuzz/minimize_qtest_trace.py index 59e91de7e2..219858a9e3 100755 --- a/scripts/oss-fuzz/minimize_qtest_trace.py +++ b/scripts/oss-fuzz/minimize_qtest_trace.py @@ -167,6 +167,42 @@ def remove_lines(newtrace, outpath): i += 1 +def clear_bits(newtrace, outpath): + # try setting bits in operands of out/write to zero + i = 0 + while i < len(newtrace): + if (not newtrace[i].startswith("write ") and not + newtrace[i].startswith("out")): + i += 1 + continue + # write ADDR SIZE DATA + # outx ADDR VALUE + print("\nzero setting bits: {}".format(newtrace[i])) + + prefix = " ".join(newtrace[i].split()[:-1]) + data = newtrace[i].split()[-1] + data_bin = bin(int(data, 16)) + data_bin_list = list(data_bin) + + for j in range(2, len(data_bin_list)): + prior = newtrace[i] + if (data_bin_list[j] == '1'): + data_bin_list[j] = '0' + data_try = hex(int("".join(data_bin_list), 2)) + # It seems qtest only accepts padded hex-values. + if len(data_try) % 2 == 1: + data_try = data_try[:2] + "0" + data_try[2:-1] + + newtrace[i] = "{prefix} {data_try}\n".format( + prefix=prefix, + data_try=data_try) + + if not check_if_trace_crashes(newtrace, outpath): + data_bin_list[j] = '1' + newtrace[i] = prior + i += 1 + + def minimize_trace(inpath, outpath): global TIMEOUT with open(inpath) as f: @@ -187,7 +223,10 @@ def minimize_trace(inpath, outpath): old_len = len(newtrace) remove_lines(newtrace, outpath) newtrace = list(filter(lambda s: s != "", newtrace)) + assert(check_if_trace_crashes(newtrace, outpath)) + # set bits to zero + clear_bits(newtrace, outpath) assert(check_if_trace_crashes(newtrace, outpath)) -- cgit v1.2.3