aboutsummaryrefslogtreecommitdiff
path: root/fuzz/fuzz_targets/does_not_decode_invalid_registers.rs
diff options
context:
space:
mode:
authoriximeow <me@iximeow.net>2023-12-16 13:26:48 -0800
committeriximeow <me@iximeow.net>2023-12-16 13:26:48 -0800
commit110f797005cca70e18cbcc0975397d26d8045245 (patch)
treea3ff79c0c3a7519d00e19d213447c268614cef00 /fuzz/fuzz_targets/does_not_decode_invalid_registers.rs
parent85668b222582ef1edae537beea452d5e1c933389 (diff)
fix opportunity for unhandled register synonyms
registers `al`, `cl`, `dl`, and `bl` could have two different representations - with `rex.w` and without. these two forms of `RegSpec` would not compare equal, nor has the same, so for code relying on `RegSpec` to faithfully represent a 1-1 mapping to x86 registers, these synonyms would introduce bugs in register analysis. for example, in `yaxpeax-core`, this would result in instructions writing to `rex.w al` not being visible as definitions for a future read of `!rex.w al`. fix this in `x86_64` code, add new test cases about the confusion, adjust register names to make this situation more clearly a bug, and introduce two new fuzz targets that would have helped spot this error.
Diffstat (limited to 'fuzz/fuzz_targets/does_not_decode_invalid_registers.rs')
-rw-r--r--fuzz/fuzz_targets/does_not_decode_invalid_registers.rs30
1 files changed, 30 insertions, 0 deletions
diff --git a/fuzz/fuzz_targets/does_not_decode_invalid_registers.rs b/fuzz/fuzz_targets/does_not_decode_invalid_registers.rs
new file mode 100644
index 0000000..0f32f73
--- /dev/null
+++ b/fuzz/fuzz_targets/does_not_decode_invalid_registers.rs
@@ -0,0 +1,30 @@
+//! instruction text should never include the word BUG - this is a symptom of selecting an invalid
+//! RegSpec while disassembling.
+
+#![no_main]
+#[macro_use] extern crate libfuzzer_sys;
+extern crate yaxpeax_x86;
+
+fuzz_target!(|data: &[u8]| {
+ let x86_64_decoder = yaxpeax_x86::long_mode::InstDecoder::default();
+ let x86_32_decoder = yaxpeax_x86::protected_mode::InstDecoder::default();
+ let x86_16_decoder = yaxpeax_x86::real_mode::InstDecoder::default();
+
+ if let Ok(inst) = x86_64_decoder.decode_slice(data) {
+ let mut res = String::new();
+ inst.write_to(&mut res).expect("format does not panic");
+ assert!(!res.contains("BUG"));
+ };
+
+ if let Ok(inst) = x86_32_decoder.decode_slice(data) {
+ let mut res = String::new();
+ inst.write_to(&mut res).expect("format does not panic");
+ assert!(!res.contains("BUG"));
+ };
+
+ if let Ok(inst) = x86_16_decoder.decode_slice(data) {
+ let mut res = String::new();
+ inst.write_to(&mut res).expect("format does not panic");
+ assert!(!res.contains("BUG"));
+ };
+});