aboutsummaryrefslogtreecommitdiff
path: root/scripts
diff options
context:
space:
mode:
authorQiuhao Li <Qiuhao.Li@outlook.com>2021-01-11 14:11:50 +0800
committerThomas Huth <thuth@redhat.com>2021-01-11 14:59:21 +0100
commit9d20f2af535a928a20eb4e5fcb782f9d43dae5ac (patch)
treeb22dc0425dfb82e047d19723274135dae2014c53 /scripts
parent247ab240c2aa391c611a5cf7b79226b89722d53e (diff)
downloadqemu-9d20f2af535a928a20eb4e5fcb782f9d43dae5ac.zip
qemu-9d20f2af535a928a20eb4e5fcb782f9d43dae5ac.tar.gz
qemu-9d20f2af535a928a20eb4e5fcb782f9d43dae5ac.tar.bz2
fuzz: set bits in operand of write/out to zero
Simplifying the crash cases by opportunistically setting bits in operands of out/write to zero may help to debug, since usually bit one means turn on or trigger a function while zero is the default turn-off setting. Tested bug https://bugs.launchpad.net/qemu/+bug/1908062 Signed-off-by: Qiuhao Li <Qiuhao.Li@outlook.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <SYCPR01MB3502C84B6346A3E3DE708C7BFCAB0@SYCPR01MB3502.ausprd01.prod.outlook.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Diffstat (limited to 'scripts')
-rwxr-xr-xscripts/oss-fuzz/minimize_qtest_trace.py39
1 files changed, 39 insertions, 0 deletions
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py b/scripts/oss-fuzz/minimize_qtest_trace.py
index 59e91de..219858a 100755
--- a/scripts/oss-fuzz/minimize_qtest_trace.py
+++ b/scripts/oss-fuzz/minimize_qtest_trace.py
@@ -167,6 +167,42 @@ def remove_lines(newtrace, outpath):
i += 1
+def clear_bits(newtrace, outpath):
+ # try setting bits in operands of out/write to zero
+ i = 0
+ while i < len(newtrace):
+ if (not newtrace[i].startswith("write ") and not
+ newtrace[i].startswith("out")):
+ i += 1
+ continue
+ # write ADDR SIZE DATA
+ # outx ADDR VALUE
+ print("\nzero setting bits: {}".format(newtrace[i]))
+
+ prefix = " ".join(newtrace[i].split()[:-1])
+ data = newtrace[i].split()[-1]
+ data_bin = bin(int(data, 16))
+ data_bin_list = list(data_bin)
+
+ for j in range(2, len(data_bin_list)):
+ prior = newtrace[i]
+ if (data_bin_list[j] == '1'):
+ data_bin_list[j] = '0'
+ data_try = hex(int("".join(data_bin_list), 2))
+ # It seems qtest only accepts padded hex-values.
+ if len(data_try) % 2 == 1:
+ data_try = data_try[:2] + "0" + data_try[2:-1]
+
+ newtrace[i] = "{prefix} {data_try}\n".format(
+ prefix=prefix,
+ data_try=data_try)
+
+ if not check_if_trace_crashes(newtrace, outpath):
+ data_bin_list[j] = '1'
+ newtrace[i] = prior
+ i += 1
+
+
def minimize_trace(inpath, outpath):
global TIMEOUT
with open(inpath) as f:
@@ -187,7 +223,10 @@ def minimize_trace(inpath, outpath):
old_len = len(newtrace)
remove_lines(newtrace, outpath)
newtrace = list(filter(lambda s: s != "", newtrace))
+ assert(check_if_trace_crashes(newtrace, outpath))
+ # set bits to zero
+ clear_bits(newtrace, outpath)
assert(check_if_trace_crashes(newtrace, outpath))