mirror of
https://github.com/xemu-project/xemu.git
synced 2024-12-19 09:48:16 +00:00
715c3f60ef
The old check was off by a factor of 512 and didn't consider cases where we don't get an exact division. This could lead to an out-of-bounds array access in seek_to_sector(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
92 lines
2.7 KiB
Bash
Executable File
92 lines
2.7 KiB
Bash
Executable File
#!/bin/bash
|
|
#
|
|
# bochs format input validation tests
|
|
#
|
|
# Copyright (C) 2013 Red Hat, Inc.
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
|
|
# creator
|
|
owner=kwolf@redhat.com
|
|
|
|
seq=`basename $0`
|
|
echo "QA output created by $seq"
|
|
|
|
here=`pwd`
|
|
tmp=/tmp/$$
|
|
status=1 # failure is the default!
|
|
|
|
_cleanup()
|
|
{
|
|
_cleanup_test_img
|
|
}
|
|
trap "_cleanup; exit \$status" 0 1 2 3 15
|
|
|
|
# get standard environment, filters and checks
|
|
. ./common.rc
|
|
. ./common.filter
|
|
|
|
_supported_fmt bochs
|
|
_supported_proto generic
|
|
_supported_os Linux
|
|
|
|
catalog_size_offset=$((0x48))
|
|
extent_size_offset=$((0x50))
|
|
disk_size_offset=$((0x58))
|
|
|
|
echo
|
|
echo "== Read from a valid image =="
|
|
_use_sample_img empty.bochs.bz2
|
|
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
|
|
|
|
echo
|
|
echo "== Negative catalog size =="
|
|
_use_sample_img empty.bochs.bz2
|
|
poke_file "$TEST_IMG" "$catalog_size_offset" "\xff\xff\xff\xff"
|
|
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
|
|
|
|
echo
|
|
echo "== Overflow for catalog size * sizeof(uint32_t) =="
|
|
_use_sample_img empty.bochs.bz2
|
|
poke_file "$TEST_IMG" "$catalog_size_offset" "\x00\x00\x00\x40"
|
|
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
|
|
|
|
echo
|
|
echo "== Too small catalog bitmap for image size =="
|
|
_use_sample_img empty.bochs.bz2
|
|
poke_file "$TEST_IMG" "$disk_size_offset" "\x00\xc0\x0f\x00\x00\x00\x00\x7f"
|
|
{ $QEMU_IO -c "read 2T 4k" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
|
|
|
|
_use_sample_img empty.bochs.bz2
|
|
poke_file "$TEST_IMG" "$catalog_size_offset" "\x10\x00\x00\x00"
|
|
{ $QEMU_IO -c "read 0xfbe00 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
|
|
|
|
echo
|
|
echo "== Negative extent size =="
|
|
_use_sample_img empty.bochs.bz2
|
|
poke_file "$TEST_IMG" "$extent_size_offset" "\x00\x00\x00\x80"
|
|
{ $QEMU_IO -c "read 768k 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
|
|
|
|
echo
|
|
echo "== Zero extent size =="
|
|
_use_sample_img empty.bochs.bz2
|
|
poke_file "$TEST_IMG" "$extent_size_offset" "\x00\x00\x00\x00"
|
|
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
|
|
|
|
# success, all done
|
|
echo "*** done"
|
|
rm -f $seq.full
|
|
status=0
|