----- "Dave Anderson" <anderson(a)redhat.com> wrote:
----- "Adrien Kunysz" <adk(a)redhat.com> wrote:
> Adrien Kunysz wrote:
> > Actually that patch fixes all the crashes I found with my previous round
> > of black box fuzzing on x86_64 (using zzuf if anyone is interested). I
> > am currently playing with bunny
> > (
http://code.google.com/p/bunny-the-fuzzer/) but I am a bit doubtful it
> > will find anything useful in any decent amount of time without some
> > manual work, oh well CPU time is cheap :)
>
> I wasn't expecting Bunny to find anything for a few days but it only took
> about three hours :)
>
> If we take the same x86_64 vmcore again:
>
> 00000000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 |.ELF............|
> 00000010 04 00 3e 00 01 00 00 00 00 00 00 00 00 00 00 00 |..>.............|
> 00000020 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |@...............|
> 00000030 00 00 00 00 40 00 38 00 03 80 00 00 00 00 00 00 |....@.8.........|
>
> and mess a bit with byte 0x39:
>
> 00000000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 |.ELF............|
> 00000010 04 00 3e 00 01 00 00 00 00 00 00 00 00 00 00 00 |..>.............|
> 00000020 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |@...............|
> 00000030 00 00 00 00 40 00 38 00 03 00 00 00 00 00 00 00 |....@.8.........|
You've got the two dumps above backwards, but as it turns out, a manual corruption
of the ELF header's e_phnum field should be pretty easy to handle -- try the attached
patch.
Thanks,
Dave