mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

tests/test-string-input-visitor: Handle errors provoked by fuzz test

Browse Source 
It's OK and expected for visitors to return errors when presented with
the fuzz test's random data. Since the fuzzer doesn't care about
errors, we pass in NULL rather than an Error**. This fixes a bug in
the fuzzer where it was passing the same Error** into each visitor,
with the effect that once one visitor returned an error, each later
visitor would notice that it had been passed in an Error** representing
an already set error, and do nothing.

For the case of visit_type_str() we also need to handle the case where
an error means that the visitor doesn't set our char*. We initialize
the pointer to NULL so we can safely g_free() it regardless of whether
the visitor allocated a string for us or not.

This fixes a problem where this test failed the MacOSX malloc()
consistency checks and might segfault on other platforms [due
to calling free() on an uninitialized pointer variable when
visit_type_str() failed.].

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
This commit is contained in:
Peter Maydell 2013-02-05 20:44:23 +00:00 committed by Luiz Capitulino
parent ecd8d4715e
commit 0184543814
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
tests/test-string-input-visitor.c
View File

@ -174,7 +174,6 @@ static void test_visitor_in_fuzz(TestInputVisitorData *data,
double nres; double nres;
char *sres; char *sres;
EnumOne eres; EnumOne eres;
Error *errp = NULL;
Visitor *v; Visitor *v;
unsigned int i; unsigned int i;
char buf[10000]; char buf[10000];
@ -193,21 +192,22 @@ static void test_visitor_in_fuzz(TestInputVisitorData *data,
} }
v = visitor_input_test_init(data, buf); v = visitor_input_test_init(data, buf);
visit_type_int(v, &ires, NULL, &errp); visit_type_int(v, &ires, NULL, NULL);
v = visitor_input_test_init(data, buf); v = visitor_input_test_init(data, buf);
visit_type_bool(v, &bres, NULL, &errp); visit_type_bool(v, &bres, NULL, NULL);
visitor_input_teardown(data, NULL); visitor_input_teardown(data, NULL);
v = visitor_input_test_init(data, buf); v = visitor_input_test_init(data, buf);
visit_type_number(v, &nres, NULL, &errp); visit_type_number(v, &nres, NULL, NULL);
v = visitor_input_test_init(data, buf); v = visitor_input_test_init(data, buf);
visit_type_str(v, &sres, NULL, &errp); sres = NULL;
visit_type_str(v, &sres, NULL, NULL);
g_free(sres); g_free(sres);
v = visitor_input_test_init(data, buf); v = visitor_input_test_init(data, buf);
visit_type_EnumOne(v, &eres, NULL, &errp); visit_type_EnumOne(v, &eres, NULL, NULL);
visitor_input_teardown(data, NULL); visitor_input_teardown(data, NULL);
} }
} }