From 31e32d1734f096d2b4c2054512fd81f8aea0eb07 Mon Sep 17 00:00:00 2001 From: practicalswift Date: Wed, 2 Dec 2015 21:55:13 +0100 Subject: [PATCH] Crash case: Jump to invalid address (0x0), sparc32 --- .gitignore | 1 + tests/regress/Makefile | 1 + tests/regress/sparc_jump_to_zero.c | 27 +++++++++++++++++++++++++++ 3 files changed, 29 insertions(+) create mode 100644 tests/regress/sparc_jump_to_zero.c diff --git a/.gitignore b/.gitignore index bea69ee4..46c06b39 100644 --- a/.gitignore +++ b/.gitignore @@ -116,6 +116,7 @@ invalid_write_in_cpu_tb_exec_x86_64 x86_16_segfault mips_invalid_read_of_size_4_when_tracing invalid_read_in_tb_flush_x86_64 +sparc_jump_to_zero ################# diff --git a/tests/regress/Makefile b/tests/regress/Makefile index a90b06fe..a2283d9d 100644 --- a/tests/regress/Makefile +++ b/tests/regress/Makefile @@ -21,6 +21,7 @@ TESTS += invalid_write_in_cpu_tb_exec_x86_64 TESTS += x86_16_segfault TESTS += mips_invalid_read_of_size_4_when_tracing TESTS += invalid_read_in_tb_flush_x86_64 +TESTS += sparc_jump_to_zero all: $(TESTS) diff --git a/tests/regress/sparc_jump_to_zero.c b/tests/regress/sparc_jump_to_zero.c new file mode 100644 index 00000000..ecef159a --- /dev/null +++ b/tests/regress/sparc_jump_to_zero.c @@ -0,0 +1,27 @@ +#include + +#define HARDWARE_ARCHITECTURE UC_ARCH_SPARC +#define HARDWARE_MODE UC_MODE_32 + +#define MEMORY_STARTING_ADDRESS 0x1000000 +#define MEMORY_SIZE 2 * 1024 * 1024 +#define MEMORY_PERMISSIONS UC_PROT_ALL + +#define BINARY_CODE "\x02\xbc" + +int main(int argc, char **argv, char **envp) { + uc_engine *uc; + if (uc_open(HARDWARE_ARCHITECTURE, HARDWARE_MODE, &uc)) { + printf("uc_open(…) failed\n"); + return 1; + } + uc_mem_map(uc, MEMORY_STARTING_ADDRESS, MEMORY_SIZE, MEMORY_PERMISSIONS); + if (uc_mem_write(uc, MEMORY_STARTING_ADDRESS, BINARY_CODE, sizeof(BINARY_CODE) - 1)) { + printf("uc_mem_write(…) failed\n"); + return 1; + } + printf("uc_emu_start(…)\n"); + uc_emu_start(uc, MEMORY_STARTING_ADDRESS, MEMORY_STARTING_ADDRESS + sizeof(BINARY_CODE) - 1, 0, 20); + printf("done\n"); + return 0; +}