mirror of
https://github.com/reactos/syzkaller.git
synced 2024-11-28 22:00:24 +00:00
f810d08444
Fuzzer has figured out how to corrupt input/output shmem regions abusing the text memcpy in syz_kvm_setup_cpu. It guessed a negative text_size value that causes the memcpy to overwrite shmem regions. Protect better against such cases: 1. Make text_size unsigned (there is already a check that it is less than 1000). 2. Map input region as readable only, we don't write to it. 3. Add address sanity check to segv_handler, if we see that we are writing into executable data, it's better to crash instantly. |
||
---|---|---|
.. | ||
common.go | ||
csource_test.go | ||
csource.go |