1 /*
2 * QTest fuzzer-generated testcase for sdcard device
3 *
4 * Copyright (c) 2021 Philippe Mathieu-Daudé <f4bug@amsat.org>
5 *
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
8
9 #include "qemu/osdep.h"
10 #include "libqtest.h"
11
12 /*
13 * https://gitlab.com/qemu-project/qemu/-/issues/450
14 * Used to trigger:
15 * Assertion `wpnum < sd->wpgrps_size' failed.
16 */
oss_fuzz_29225(void)17 static void oss_fuzz_29225(void)
18 {
19 QTestState *s;
20
21 s = qtest_init(" -m 512m -nodefaults -nographic"
22 " -device sdhci-pci,sd-spec-version=3"
23 " -device sd-card,drive=d0"
24 " -drive if=none,index=0,file=null-co://,format=raw,id=d0");
25
26 qtest_outl(s, 0xcf8, 0x80001010);
27 qtest_outl(s, 0xcfc, 0xd0690);
28 qtest_outl(s, 0xcf8, 0x80001003);
29 qtest_outl(s, 0xcf8, 0x80001013);
30 qtest_outl(s, 0xcfc, 0xffffffff);
31 qtest_outl(s, 0xcf8, 0x80001003);
32 qtest_outl(s, 0xcfc, 0x3effe00);
33
34 qtest_bufwrite(s, 0xff0d062c, "\xff", 0x1);
35 qtest_bufwrite(s, 0xff0d060f, "\xb7", 0x1);
36 qtest_bufwrite(s, 0xff0d060a, "\xc9", 0x1);
37 qtest_bufwrite(s, 0xff0d060f, "\x29", 0x1);
38 qtest_bufwrite(s, 0xff0d060f, "\xc2", 0x1);
39 qtest_bufwrite(s, 0xff0d0628, "\xf7", 0x1);
40 qtest_bufwrite(s, 0x0, "\xe3", 0x1);
41 qtest_bufwrite(s, 0x7, "\x13", 0x1);
42 qtest_bufwrite(s, 0x8, "\xe3", 0x1);
43 qtest_bufwrite(s, 0xf, "\xe3", 0x1);
44 qtest_bufwrite(s, 0xff0d060f, "\x03", 0x1);
45 qtest_bufwrite(s, 0xff0d0605, "\x01", 0x1);
46 qtest_bufwrite(s, 0xff0d060b, "\xff", 0x1);
47 qtest_bufwrite(s, 0xff0d060c, "\xff", 0x1);
48 qtest_bufwrite(s, 0xff0d060e, "\xff", 0x1);
49 qtest_bufwrite(s, 0xff0d060f, "\x06", 0x1);
50 qtest_bufwrite(s, 0xff0d060f, "\x9e", 0x1);
51
52 qtest_quit(s);
53 }
54
55 /*
56 * https://gitlab.com/qemu-project/qemu/-/issues/495
57 * Used to trigger:
58 * Assertion `wpnum < sd->wpgrps_size' failed.
59 */
oss_fuzz_36217(void)60 static void oss_fuzz_36217(void)
61 {
62 QTestState *s;
63
64 s = qtest_init(" -m 32 -nodefaults -nographic"
65 " -device sdhci-pci,sd-spec-version=3 "
66 "-device sd-card,drive=d0 "
67 "-drive if=none,index=0,file=null-co://,format=raw,id=d0");
68
69 qtest_outl(s, 0xcf8, 0x80001010);
70 qtest_outl(s, 0xcfc, 0xe0000000);
71 qtest_outl(s, 0xcf8, 0x80001004);
72 qtest_outw(s, 0xcfc, 0x02);
73 qtest_bufwrite(s, 0xe000002c, "\x05", 0x1);
74 qtest_bufwrite(s, 0xe000000f, "\x37", 0x1);
75 qtest_bufwrite(s, 0xe000000a, "\x01", 0x1);
76 qtest_bufwrite(s, 0xe000000f, "\x29", 0x1);
77 qtest_bufwrite(s, 0xe000000f, "\x02", 0x1);
78 qtest_bufwrite(s, 0xe000000f, "\x03", 0x1);
79 qtest_bufwrite(s, 0xe0000005, "\x01", 0x1);
80 qtest_bufwrite(s, 0xe000000f, "\x06", 0x1);
81 qtest_bufwrite(s, 0xe000000c, "\x05", 0x1);
82 qtest_bufwrite(s, 0xe000000e, "\x20", 0x1);
83 qtest_bufwrite(s, 0xe000000f, "\x08", 0x1);
84 qtest_bufwrite(s, 0xe000000b, "\x3d", 0x1);
85 qtest_bufwrite(s, 0xe000000f, "\x1e", 0x1);
86
87 qtest_quit(s);
88 }
89
90 /*
91 * https://gitlab.com/qemu-project/qemu/-/issues/451
92 * Used to trigger a heap buffer overflow.
93 */
oss_fuzz_36391(void)94 static void oss_fuzz_36391(void)
95 {
96 QTestState *s;
97
98 s = qtest_init(" -m 512M -nodefaults -nographic"
99 " -device sdhci-pci,sd-spec-version=3"
100 " -device sd-card,drive=drv"
101 " -drive if=none,index=0,file=null-co://,format=raw,id=drv");
102 qtest_outl(s, 0xcf8, 0x80001010);
103 qtest_outl(s, 0xcfc, 0xe0000000);
104 qtest_outl(s, 0xcf8, 0x80001004);
105 qtest_outw(s, 0xcfc, 0x7);
106 qtest_bufwrite(s, 0xe0000005, "\x73", 0x1);
107 qtest_bufwrite(s, 0xe0000028, "\x55", 0x1);
108 qtest_bufwrite(s, 0xe000002c, "\x55", 0x1);
109 qtest_bufwrite(s, 0x0, "\x65", 0x1);
110 qtest_bufwrite(s, 0x7, "\x69", 0x1);
111 qtest_bufwrite(s, 0x8, "\x65", 0x1);
112 qtest_bufwrite(s, 0xf, "\x69", 0x1);
113 qtest_bufwrite(s, 0x10, "\x65", 0x1);
114 qtest_bufwrite(s, 0x17, "\x69", 0x1);
115 qtest_bufwrite(s, 0x18, "\x65", 0x1);
116 qtest_bufwrite(s, 0x1f, "\x69", 0x1);
117 qtest_bufwrite(s, 0x20, "\x65", 0x1);
118 qtest_bufwrite(s, 0x27, "\x69", 0x1);
119 qtest_bufwrite(s, 0x28, "\x65", 0x1);
120 qtest_bufwrite(s, 0x2f, "\x69", 0x1);
121 qtest_bufwrite(s, 0x30, "\x65", 0x1);
122 qtest_bufwrite(s, 0x37, "\x69", 0x1);
123 qtest_bufwrite(s, 0x38, "\x65", 0x1);
124 qtest_bufwrite(s, 0x3f, "\x69", 0x1);
125 qtest_bufwrite(s, 0x40, "\x65", 0x1);
126 qtest_bufwrite(s, 0x47, "\x69", 0x1);
127 qtest_bufwrite(s, 0x48, "\x65", 0x1);
128 qtest_bufwrite(s, 0xe000000c, "\x55", 0x1);
129 qtest_bufwrite(s, 0xe000000e, "\x2c", 0x1);
130 qtest_bufwrite(s, 0xe000000f, "\x5b", 0x1);
131 qtest_bufwrite(s, 0xe0000010, "\x06\x46", 0x2);
132 qtest_bufwrite(s, 0x50, "\x65", 0x1);
133 qtest_bufwrite(s, 0x57, "\x69", 0x1);
134 qtest_bufwrite(s, 0x58, "\x65", 0x1);
135 qtest_bufwrite(s, 0x5f, "\x69", 0x1);
136 qtest_bufwrite(s, 0x60, "\x65", 0x1);
137 qtest_bufwrite(s, 0x67, "\x69", 0x1);
138 qtest_bufwrite(s, 0x68, "\x65", 0x1);
139 qtest_bufwrite(s, 0x6f, "\x69", 0x1);
140 qtest_bufwrite(s, 0x70, "\x65", 0x1);
141 qtest_bufwrite(s, 0x77, "\x69", 0x1);
142 qtest_bufwrite(s, 0x78, "\x65", 0x1);
143 qtest_bufwrite(s, 0x7f, "\x69", 0x1);
144 qtest_bufwrite(s, 0x80, "\x65", 0x1);
145 qtest_bufwrite(s, 0x87, "\x69", 0x1);
146 qtest_bufwrite(s, 0x88, "\x65", 0x1);
147 qtest_bufwrite(s, 0x8f, "\x69", 0x1);
148 qtest_bufwrite(s, 0x90, "\x65", 0x1);
149 qtest_bufwrite(s, 0x97, "\x69", 0x1);
150 qtest_bufwrite(s, 0x98, "\x65", 0x1);
151 qtest_bufwrite(s, 0xe0000026, "\x5a\x06", 0x2);
152 qtest_bufwrite(s, 0xe0000028, "\x46\xc0\xc9\xc9", 0x4);
153 qtest_bufwrite(s, 0xe0000028, "\x55", 0x1);
154 qtest_bufwrite(s, 0xe000002a, "\x5a", 0x1);
155 qtest_bufwrite(s, 0xa0, "\x65", 0x1);
156 qtest_bufwrite(s, 0xa5, "\xff", 0x1);
157 qtest_bufwrite(s, 0xa6, "\xff", 0x1);
158 qtest_bufwrite(s, 0xa7, "\xdf", 0x1);
159 qtest_bufwrite(s, 0xe000000c, "\x27", 0x1);
160 qtest_bufwrite(s, 0xe000000f, "\x55", 0x1);
161
162 qtest_quit(s);
163 }
164
main(int argc,char ** argv)165 int main(int argc, char **argv)
166 {
167 g_test_init(&argc, &argv, NULL);
168
169 qtest_add_func("fuzz/sdcard/oss_fuzz_29225", oss_fuzz_29225);
170 qtest_add_func("fuzz/sdcard/oss_fuzz_36217", oss_fuzz_36217);
171 qtest_add_func("fuzz/sdcard/oss_fuzz_36391", oss_fuzz_36391);
172
173 return g_test_run();
174 }
175