diff options
author | Qiuhao Li <Qiuhao.Li@outlook.com> | 2021-01-11 14:11:50 +0800 |
---|---|---|
committer | Thomas Huth <thuth@redhat.com> | 2021-01-11 14:59:21 +0100 |
commit | 9d20f2af535a928a20eb4e5fcb782f9d43dae5ac (patch) | |
tree | b22dc0425dfb82e047d19723274135dae2014c53 /scripts | |
parent | 247ab240c2aa391c611a5cf7b79226b89722d53e (diff) | |
download | qemu-9d20f2af535a928a20eb4e5fcb782f9d43dae5ac.zip qemu-9d20f2af535a928a20eb4e5fcb782f9d43dae5ac.tar.gz qemu-9d20f2af535a928a20eb4e5fcb782f9d43dae5ac.tar.bz2 |
fuzz: set bits in operand of write/out to zero
Simplifying the crash cases by opportunistically setting bits in operands of
out/write to zero may help to debug, since usually bit one means turn on or
trigger a function while zero is the default turn-off setting.
Tested bug https://bugs.launchpad.net/qemu/+bug/1908062
Signed-off-by: Qiuhao Li <Qiuhao.Li@outlook.com>
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <SYCPR01MB3502C84B6346A3E3DE708C7BFCAB0@SYCPR01MB3502.ausprd01.prod.outlook.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Diffstat (limited to 'scripts')
-rwxr-xr-x | scripts/oss-fuzz/minimize_qtest_trace.py | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py b/scripts/oss-fuzz/minimize_qtest_trace.py index 59e91de..219858a 100755 --- a/scripts/oss-fuzz/minimize_qtest_trace.py +++ b/scripts/oss-fuzz/minimize_qtest_trace.py @@ -167,6 +167,42 @@ def remove_lines(newtrace, outpath): i += 1 +def clear_bits(newtrace, outpath): + # try setting bits in operands of out/write to zero + i = 0 + while i < len(newtrace): + if (not newtrace[i].startswith("write ") and not + newtrace[i].startswith("out")): + i += 1 + continue + # write ADDR SIZE DATA + # outx ADDR VALUE + print("\nzero setting bits: {}".format(newtrace[i])) + + prefix = " ".join(newtrace[i].split()[:-1]) + data = newtrace[i].split()[-1] + data_bin = bin(int(data, 16)) + data_bin_list = list(data_bin) + + for j in range(2, len(data_bin_list)): + prior = newtrace[i] + if (data_bin_list[j] == '1'): + data_bin_list[j] = '0' + data_try = hex(int("".join(data_bin_list), 2)) + # It seems qtest only accepts padded hex-values. + if len(data_try) % 2 == 1: + data_try = data_try[:2] + "0" + data_try[2:-1] + + newtrace[i] = "{prefix} {data_try}\n".format( + prefix=prefix, + data_try=data_try) + + if not check_if_trace_crashes(newtrace, outpath): + data_bin_list[j] = '1' + newtrace[i] = prior + i += 1 + + def minimize_trace(inpath, outpath): global TIMEOUT with open(inpath) as f: @@ -187,7 +223,10 @@ def minimize_trace(inpath, outpath): old_len = len(newtrace) remove_lines(newtrace, outpath) newtrace = list(filter(lambda s: s != "", newtrace)) + assert(check_if_trace_crashes(newtrace, outpath)) + # set bits to zero + clear_bits(newtrace, outpath) assert(check_if_trace_crashes(newtrace, outpath)) |