Open derekbruening opened 8 years ago
For fuzz test, the error comes from the wrong fuzz target function size argument.
We tries to get size info from repeatme(buffer, size)
. However, in get_priv_mcontext_from_dstack
gdb) p/x *(priv_mcontext_t *)(dcontext->dstack - sizeof(priv_mcontext_t))
$10 = {r0 = 0xbe8fca50, r1 = 0x55059c98, r2 = 0xb0850858, r3 = 0x10, r4 = 0x4, r5 = 0x2, r6 = 0xb0f59828, r7 = 0xbe8fca44, r8 = 0x2, r9 = 0xbe8fca50, r10 = 0x0, r11 = 0x0, r12 = 0x54e29000, {
r13 = 0xbe8fca0c, sp = 0xbe8fca0c, xsp = 0xbe8fca0c}, {r14 = 0x7399e501, lr = 0x7399e501}, {r15 = 0x54e3aec4, pc = 0x54e3aec4}, {xflags = 0xb0f59a54, apsr = 0xb0f59a54, cpsr = 0xb0f59a54},
...
It looks like the value is off by two reg size, where r2 is holding the actual r0 value, and r3 is holding the r1 value.
The cause is in insert_push_all_registers
, which did not preserve the mcontext struct.
Split from #1726
These are tests I had to disable from the already-limited set of pattern-only tests we set up for x64, as it is non-trivial to get them working. After fixing these we should extend the set of tests for both x64 and Android.
*\ TODO fuzz tests fail with disturbing heap alloc failures
*\ TODO line numbers are off?
*\ TODO exitcode tests fail b/c adb shell doesn't return the code
This is a known bug in adb: https://code.google.com/p/android/issues/detail?id=3254
*\ TODO shell-interpreted chars in fuzz descriptors make running over adb shell very painful
Actually it's quite difficult to escape all these chars through "adb shell" and "/system/bin/sh": I gave up after a few attempts.
*\ TODO unit_tests claims to pass but fails