| Message ID | 20170925142648.25959-5-george.dunlap@citrix.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
>>> On 25.09.17 at 16:26, <george.dunlap@citrix.com> wrote: > --- a/tools/fuzz/x86_instruction_emulator/fuzz-emul.c > +++ b/tools/fuzz/x86_instruction_emulator/fuzz-emul.c > @@ -52,6 +52,22 @@ struct fuzz_state > struct x86_emulate_ops ops; > }; > > +static inline bool input_available(struct fuzz_state *s, size_t size) s can be pointer to const Also how about shortening the function name to what the title says? > +{ > + return s->data_index + size < s->data_num; Shouldn't this be <= ? > +} > + > +static inline bool input_read(struct fuzz_state *s, void *dst, size_t size) > +{ > + if ( !input_available(s, size) ) > + return 0; false > + > + memcpy(dst, &s->corpus->data[s->data_index], size); > + s->data_index += size; > + > + return 1; true Jan
On 10/04/2017 09:22 AM, Jan Beulich wrote: >>>> On 25.09.17 at 16:26, <george.dunlap@citrix.com> wrote: >> --- a/tools/fuzz/x86_instruction_emulator/fuzz-emul.c >> +++ b/tools/fuzz/x86_instruction_emulator/fuzz-emul.c >> @@ -52,6 +52,22 @@ struct fuzz_state >> struct x86_emulate_ops ops; >> }; >> >> +static inline bool input_available(struct fuzz_state *s, size_t size) > > s can be pointer to const > > Also how about shortening the function name to what the title says? Sure. > >> +{ >> + return s->data_index + size < s->data_num; > > Shouldn't this be <= ? Yes actually. > >> +} >> + >> +static inline bool input_read(struct fuzz_state *s, void *dst, size_t size) >> +{ >> + if ( !input_available(s, size) ) >> + return 0; > > false > >> + >> + memcpy(dst, &s->corpus->data[s->data_index], size); >> + s->data_index += size; >> + >> + return 1; > > true Ack. -George
diff --git a/tools/fuzz/x86_instruction_emulator/fuzz-emul.c b/tools/fuzz/x86_instruction_emulator/fuzz-emul.c index 761b2ae96e..92684cf088 100644 --- a/tools/fuzz/x86_instruction_emulator/fuzz-emul.c +++ b/tools/fuzz/x86_instruction_emulator/fuzz-emul.c @@ -52,6 +52,22 @@ struct fuzz_state struct x86_emulate_ops ops; }; +static inline bool input_available(struct fuzz_state *s, size_t size) +{ + return s->data_index + size < s->data_num; +} + +static inline bool input_read(struct fuzz_state *s, void *dst, size_t size) +{ + if ( !input_available(s, size) ) + return 0; + + memcpy(dst, &s->corpus->data[s->data_index], size); + s->data_index += size; + + return 1; +} + char *x86emul_return_string[] = { [X86EMUL_OKAY] = "X86EMUL_OKAY", [X86EMUL_UNHANDLEABLE] = "X86EMUL_UNHANDLEABLE", @@ -68,10 +84,10 @@ static int maybe_fail(struct x86_emulate_ctxt *ctxt, const char *why, bool exception) { struct fuzz_state *s = ctxt->data; - const struct fuzz_corpus *c = s->corpus; + unsigned char c; int rc; - if ( s->data_index >= s->data_num ) + if ( !input_read(s, &c, sizeof(c)) ) rc = X86EMUL_EXCEPTION; else { @@ -80,13 +96,12 @@ static int maybe_fail(struct x86_emulate_ctxt *ctxt, * 25% unhandlable * 25% exception */ - if ( c->data[s->data_index] > 0xc0 ) + if ( c > 0xc0 ) rc = X86EMUL_EXCEPTION; - else if ( c->data[s->data_index] > 0x80 ) + else if ( c > 0x80 ) rc = X86EMUL_UNHANDLEABLE; else rc = X86EMUL_OKAY; - s->data_index++; } if ( rc == X86EMUL_EXCEPTION && !exception ) @@ -106,11 +121,10 @@ static int data_read(struct x86_emulate_ctxt *ctxt, const char *why, void *dst, unsigned int bytes) { struct fuzz_state *s = ctxt->data; - const struct fuzz_corpus *c = s->corpus; unsigned int i; int rc; - if ( s->data_index + bytes > s->data_num ) + if ( !input_available(s, bytes) ) { /* * Fake up a segment limit violation. System segment limit volations @@ -128,8 +142,7 @@ static int data_read(struct x86_emulate_ctxt *ctxt, if ( rc == X86EMUL_OKAY ) { - memcpy(dst, &c->data[s->data_index], bytes); - s->data_index += bytes; + input_read(s, dst, bytes); printf("%s: ", why); for ( i = 0; i < bytes; i++ )
Rather than open-coding the "read" from the input file. Signed-off-by: George Dunlap <george.dunlap@citrix.com> --- v2: - Use less dread-ful names - Return bool rather than int CC: Ian Jackson <ian.jackson@citrix.com> CC: Wei Liu <wei.liu2@citrix.com> CC: Andrew Cooper <andrew.cooper3@citrix.com> CC: Jan Beulich <jbeulich@suse.com> --- tools/fuzz/x86_instruction_emulator/fuzz-emul.c | 31 ++++++++++++++++++------- 1 file changed, 22 insertions(+), 9 deletions(-)