Package FuzzManager :: Package FTB :: Package Signatures :: Module tests
[hide private]
[frames] | no frames]

Module tests

source code

Tests


Author: Christian Holler (:decoder)

License:

This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.

Contact: choller@mozilla.com

Classes [hide private]
  ASanParserTestCrash
  ASanParserTestHeapCrash
  ASanParserTestUAF
  ASanDetectionTest
  GDBParserTestCrash
  GDBParserTestCrashAddress
  GDBParserTestCrashAddressSimple
  GDBParserTestRegression1
  GDBParserTestCrashAddressRegression2
  GDBParserTestCrashAddressRegression3
  GDBParserTestCrashAddressRegression4
  CrashSignatureOutputTest
  CrashSignatureAddressTest
  CrashSignatureRegisterTest
  CrashSignatureStackFrameTest
  CrashSignatureStackSizeTest
  RegisterHelperValueTest
  MinidumpParserTestCrash
  MinidumpSelectorTest
  AppleParserTestCrash
  AppleSelectorTest
  UBSanParserTestCrash
Variables [hide private]
  asanTraceCrash = '\nASAN:SIGSEGV\n============================...
  asanTraceHeapCrash = '\nASAN:SIGSEGV\n========================...
  asanTraceUAF = '\n==19462==ERROR: AddressSanitizer: heap-use-a...
  gdbCrashAddress1 = '\n(gdb) bt 16 \n#0 js::types::TypeObject:...
  gdbCrashAddress2 = '\nProgram terminated with signal 11, Segme...
  gdbCrashAddress3 = ' \n(gdb) bt 16 \n#0 js::types::Type...
  gdbSampleTrace1 = '\n[New Thread 14711]\n[Thread debugging usi...
  gdbSampleTrace2 = '\nProgram terminated with signal 11, Segmen...
  gdbSampleTrace3 = '\nProgram terminated with signal 11, Segmen...
  gdbRegressionTrace1 = '\nProgram received signal SIGSEGV, Segm...
  gdbRegressionTrace2 = '\nProgram received signal SIGSEGV, Segm...
  gdbRegressionTrace3 = '\nProgram received signal SIGTRAP, Trac...
  gdbRegressionTrace4 = '\nProgram received signal SIGSEGV, Segm...
  ubsanSampleTrace1 = '\ncodec/decoder/core/inc/dec_golomb.h:182...
  __package__ = 'FuzzManager.FTB.Signatures'
Variables Details [hide private]

asanTraceCrash

Value:
'''
ASAN:SIGSEGV
=================================================================
==5854==ERROR: AddressSanitizer: SEGV on unknown address 0x00000014 (p\
c 0x0810845f sp 0xffc57860 bp 0xffc57f18 T0)
    #0 0x810845e in js::AbstractFramePtr::asRematerializedFrame() cons\
t /srv/repos/mozilla-central/js/src/shell/../jit/RematerializedFrame.h\
:114
...

asanTraceHeapCrash

Value:
'''
ASAN:SIGSEGV
=================================================================
==11923==ERROR: AddressSanitizer: SEGV on unknown address 0x00000019 (\
pc 0xf718072e sp 0xff87d130 bp 0x000006a1 T0)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 ??
...

asanTraceUAF

Value:
'''
==19462==ERROR: AddressSanitizer: heap-use-after-free on address 0x7fd\
766c42800 at pc 0xe1f587 bp 0x7fffcb1b6ed0 sp 0x7fffcb1b6ec8
READ of size 6143520 at 0x7fd766c42800 thread T0
    #0 0xe1f586 in void mozilla::PodCopy<char16_t>(char16_t*, char16_t\
 const*, unsigned long) /srv/repos/mozilla-central/js/src/opt64asan/js\
/src/../../dist/include/mozilla/PodOperations.h:110
    #1 0x5904e2 in js::frontend::CompileScript(js::ExclusiveContext*, \
...

gdbCrashAddress1

Value:
'''
(gdb) bt 16 
#0  js::types::TypeObject::addProperty (this=0xf7469400, cx=0x9366458,\
 id=$jsid(0x0), pprop=0xf7469418) at /srv/repos/mozilla-central/js/src\
/jsinfer.cpp:3691 
(More stack frames follow...) 
(gdb) info reg 
eax            0x1      1
...

gdbCrashAddress2

Value:
'''
Program terminated with signal 11, Segmentation fault. 
#0  repoint (this=0x160fc30, cx=0x15a4940, masm=..., attacher=..., ion\
=0x160fa80, attachKind=0x2b08c0 "generic") at /srv/repos/mozilla-centr\
al/js/src/ion/IonCaches.cpp:44 
#1  CodeLocationJump (this=0x160fc30, cx=0x15a4940, masm=..., attacher\
=..., ion=0x160fa80, attachKind=0x2b08c0 "generic") at ../ion/shared/A\
ssembler-shared.h:452 
...

gdbCrashAddress3

Value:
'''       
(gdb) bt 16 
#0  js::types::TypeObject::addProperty (this=0xf7469400, cx=0x9366458,\
 id=$jsid(0x0), pprop=0xf7469418) at /srv/repos/mozilla-central/js/src\
/jsinfer.cpp:3691 
(More stack frames follow...) 
(gdb) info reg 
rax            0x1      1
...

gdbSampleTrace1

Value:
'''
[New Thread 14711]
[Thread debugging using libthread_db enabled]
Core was generated by `/srv/repos/ionmonkey/js/src/opt32/js --ion -n -\
m --ion-eager -f /home/ownhero/h\'.
Program terminated with signal 11, Segmentation fault.
#0  0x083fa060 in internalAppend<js::ion::MDefinition*> (this=0x847e4e\
8, ins=0x9e2ced0) at ./dist/include/js/Vector.h:790
...

gdbSampleTrace2

Value:
'''
Program terminated with signal 11, Segmentation fault.
#0  operator+ (this=0xf6c7e760, cx=0xa3024b8, iv=..., useLocale=false,\
 buffer=..., sb=...) at ../gc/Barrier.h:462
462         HeapSlotArray operator +(uint32_t offset) const { return H\
eapSlotArray(array + offset); }
#0  operator+ (this=0xf6c7e760, cx=0xa3024b8, iv=..., useLocale=false,\
 buffer=..., sb=...) at ../gc/Barrier.h:462
...

gdbSampleTrace3

Value:
'''
Program terminated with signal 11, Segmentation fault.
#0  0x083ba5a9 in AssertCanGC () at /srv/repos/ionmonkey/js/src/gc/Roo\
t.h:1029
1029        JS_ASSERT_IF(isGCEnabled(), !InNoGCScope());
#0  0x083ba5a9 in AssertCanGC () at /srv/repos/ionmonkey/js/src/gc/Roo\
t.h:1029
#1  js::gc::NewGCThing<JSString, (js::AllowGC)1> (cx=0x9224850, kind=j\
...

gdbRegressionTrace1

Value:
'''
Program received signal SIGSEGV, Segmentation fault.
js::ScriptedIndirectProxyHandler::defineProperty (this=0x930fad4, cx=0\
x9339130, proxy=(JSObject * const) 0xf6700050 [object Array], id=$jsid\
(0), desc={obj = (JSObject *) 0xf6247040 [object Proxy], attrs = 61524\
, getter = 0xf6700120, setter = 0, value = $jsval(-nan(0xfff88f62460d0\
))}) at /srv/repos/mozilla-central/js/src/proxy/ScriptedIndirectProxyH\
andler.cpp:201
...

gdbRegressionTrace2

Value:
'''
Program received signal SIGSEGV, Segmentation fault.
0xf7673132 in ?? ()
#0  0xf7673132 in ?? ()
eax            0xf6043040    -167497664
ecx            0xf651f4b0    -162401104
edx            0xf651f4d0    -162401072
ebx            0xf651f4f0    -162401040
...

gdbRegressionTrace3

Value:
'''
Program received signal SIGTRAP, Trace/breakpoint trap.
0x00007ffff5573368 in ?? ()
#0  0x00007ffff5573368 in ?? ()
#1  0x00007ffff558a9c9 in ?? ()
#2  0x0000000000000183 in ?? ()
#3  0x00007ffff5671ac0 in ?? ()
#4  0x0000000000000000 in ?? ()
...

gdbRegressionTrace4

Value:
'''
Program received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
#0  0x0000000000000000 in ?? ()
#1 0xfffc7ffff7e8a6c0 in ?? ()
#2 0x000000000043026c in js::jit::IonCompile (cx=0xfffc7ffff7e766c0, s\
cript=<optimized out>, baselineFrame=<optimized out>, osrPc=<optimized\
 out>, constructing=<optimized out>, recompile=<optimized out>, optimi\
...

ubsanSampleTrace1

Value:
'''
codec/decoder/core/inc/dec_golomb.h:182:37: runtime error: signed inte\
ger overflow: -2147483648 - 1 cannot be represented in type \'int\'
    #0 0x51353a in WelsDec::BsGetUe(WelsCommon::TagBitStringAux*, unsi\
gned int*) /home/user/code/openh264/./codec/decoder/core/inc/dec_golom\
b.h:182:37
    #1 0x51a11b in WelsDec::ParseSliceHeaderSyntaxs(WelsDec::TagWelsDe\
coderContext*, WelsCommon::TagBitStringAux*, bool) /home/user/code/ope\
...