diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2021-09-01 10:57:30 +0100 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2021-09-01 10:57:30 +0100 |
| commit | 783aa010ade5e2f8dd33a654882f2a14ab96c0a1 (patch) | |
| tree | 48baaa37a61a47c78a1f706d9789fdaa0cf5112a /tests | |
| parent | ec397e90d21269037280633b6058d1f280e27667 (diff) | |
| parent | 01f750f5fef1afd8f6abc0548910f87d473e26d5 (diff) | |
Merge remote-tracking branch 'remotes/kraxel/tags/vga-20210901-pull-request' into staging
vga: misc fixes and cleanups.
# gpg: Signature made Wed 01 Sep 2021 05:18:46 BST
# gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138
* remotes/kraxel/tags/vga-20210901-pull-request:
hw/display/artist: Fix bug in coordinate extraction in artist_vram_read() and artist_vram_write()
hw/display/xlnx_dp: fix an out-of-bounds read in xlnx_dp_read
vga: don't abort when adding a duplicate isa-vga device
ui/console: Restrict udmabuf_fd() to Linux
hw/display: Restrict virtio-gpu-udmabuf stubs to !Linux
virtio-gpu: no point of checking res->iov
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/qtest/fuzz-xlnx-dp-test.c | 33 | ||||
| -rw-r--r-- | tests/qtest/meson.build | 1 |
2 files changed, 34 insertions, 0 deletions
diff --git a/tests/qtest/fuzz-xlnx-dp-test.c b/tests/qtest/fuzz-xlnx-dp-test.c new file mode 100644 index 0000000000..69eb6c0eb1 --- /dev/null +++ b/tests/qtest/fuzz-xlnx-dp-test.c @@ -0,0 +1,33 @@ +/* + * QTest fuzzer-generated testcase for xlnx-dp display device + * + * Copyright (c) 2021 Qiang Liu <cyruscyliu@gmail.com> + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "libqos/libqtest.h" + +/* + * This used to trigger the out-of-bounds read in xlnx_dp_read + */ +static void test_fuzz_xlnx_dp_0x3ac(void) +{ + QTestState *s = qtest_init("-M xlnx-zcu102 -display none "); + qtest_readl(s, 0xfd4a03ac); + qtest_quit(s); +} + +int main(int argc, char **argv) +{ + const char *arch = qtest_get_arch(); + + g_test_init(&argc, &argv, NULL); + + if (strcmp(arch, "aarch64") == 0) { + qtest_add_func("fuzz/test_fuzz_xlnx_dp/3ac", test_fuzz_xlnx_dp_0x3ac); + } + + return g_test_run(); +} diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build index 2bc3efd49f..757bb8499a 100644 --- a/tests/qtest/meson.build +++ b/tests/qtest/meson.build @@ -187,6 +187,7 @@ qtests_aarch64 = \ 'numa-test', 'boot-serial-test', 'xlnx-can-test', + 'fuzz-xlnx-dp-test', 'migration-test'] qtests_s390x = \ |