Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed invalid addresses in read hooks #70

Merged
merged 1 commit into from
May 3, 2024

Conversation

saibotk
Copy link
Contributor

@saibotk saibotk commented Apr 30, 2024

When using the new QEMU version, the read hooks sometimes returned invalid addresses like 0x1 or 0x1000.

For reference this commit in upstream QEMU is relevant, where the handling for addresses was adjusted: https://gitlab.com/qemu-project/qemu/-/commit/d5920b7280762d4d696bff87f50dbce453adef06

And in https://gitlab.com/qemu-project/qemu/-/commit/eb9d02f24b1ce877a60ffaf6cc1ecc8484740b37 we can see, that QEMU temporarily stores the address in a TCGTemp variable, because it can get corrupted by the operation via overlaps.

To mimic QEMUs behavior, we copied the plugin_maybe_preserve_addr function, and used it in the same places as QEMU also does for its memory plugin callbacks.

Note that we copied this and technically repeat the same code, but QEMU disables all those functions when the plugin feature is disabled.

And we do not add extra logic that is found in the plugin mem callback generation function plugin_gen_mem_callbacks because in those specific cases the function will always just use the preserved address anyway. The function just contains the same logic as a fallback when no copy_addr was given as a parameter.

Additionally, we are now correctly using the original memop variable in the same way the plugin callback does. This should now be more consistent.

@saibotk saibotk force-pushed the fix-read-addresses branch 2 times, most recently from 215a55d to 84dc5ff Compare April 30, 2024 11:42
When using the new QEMU version, the read hooks sometimes returned invalid addresses like 0x1 or 0x1000.

For reference this commit in upstream QEMU is relevant, where the handling for addresses was adjusted:
https://gitlab.com/qemu-project/qemu/-/commit/d5920b7280762d4d696bff87f50dbce453adef06

And in https://gitlab.com/qemu-project/qemu/-/commit/eb9d02f24b1ce877a60ffaf6cc1ecc8484740b37 we can see, that QEMU temporarily stores the address in a TCGTemp variable, because it can get corrupted by the operation via overlaps.

To mimic QEMUs behavior, we copied the `plugin_maybe_preserve_addr` function, and used it in the same places as QEMU also does for its memory plugin callbacks.

Note that we copied this and technically repeat the same code, but QEMU disables all those functions when the plugin feature is disabled.

And we do not add extra logic that is found in the plugin mem callback generation function `plugin_gen_mem_callbacks` because in those specific cases the function will always just use the preserved address anyway. The function just contains the same logic as a fallback when no copy_addr was given as a parameter.

Additionally, we are now correctly using the original memop variable in
the same way the plugin callback does. This should now be more
consistent.
@rmalmain rmalmain force-pushed the fix-read-addresses branch from 84dc5ff to f029f47 Compare May 2, 2024 07:48
@rmalmain
Copy link
Member

rmalmain commented May 3, 2024

Looks good to me, thanks for the PR

@rmalmain rmalmain merged commit 3ebc96e into AFLplusplus:main May 3, 2024
1 check passed
@saibotk saibotk deleted the fix-read-addresses branch May 3, 2024 11:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants