From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:59430) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1U1kUz-0005Ax-Pd for qemu-devel@nongnu.org; Sat, 02 Feb 2013 16:19:47 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1U1kUx-0007io-7T for qemu-devel@nongnu.org; Sat, 02 Feb 2013 16:19:45 -0500 Received: from 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.d.1.0.0.b.8.0.1.0.0.2.ip6.arpa ([2001:8b0:1d0::1]:60228 helo=mnementh.archaic.org.uk) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1U1kUx-0007ik-0C for qemu-devel@nongnu.org; Sat, 02 Feb 2013 16:19:43 -0500 From: Peter Maydell Date: Sat, 2 Feb 2013 21:19:39 +0000 Message-Id: <1359839979-26852-1-git-send-email-peter.maydell@linaro.org> Subject: [Qemu-devel] [PATCH for-1.4] tests/test-string-input-visitor: Handle errors provoked by fuzz test List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Blue Swirl , Kevin Wolf , patches@linaro.org It's OK and expected for visitors to return errors when presented with the fuzz test's random data. This means the test harness needs to handle them; check for and free any error after each visitor call, and only free the string returned by visit_type_str if visit_type_str succeeded. This fixes a problem where this test failed the MacOSX malloc() consistency checks and might segfault on other platforms [due to calling free() on an uninitialized pointer variable]. Signed-off-by: Peter Maydell --- tests/test-string-input-visitor.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/tests/test-string-input-visitor.c b/tests/test-string-input-visitor.c index f6b0093..793b334 100644 --- a/tests/test-string-input-visitor.c +++ b/tests/test-string-input-visitor.c @@ -194,20 +194,41 @@ static void test_visitor_in_fuzz(TestInputVisitorData *data, v = visitor_input_test_init(data, buf); visit_type_int(v, &ires, NULL, &errp); + if (error_is_set(&errp)) { + error_free(errp); + errp = NULL; + } v = visitor_input_test_init(data, buf); visit_type_bool(v, &bres, NULL, &errp); + if (error_is_set(&errp)) { + error_free(errp); + errp = NULL; + } visitor_input_teardown(data, NULL); v = visitor_input_test_init(data, buf); visit_type_number(v, &nres, NULL, &errp); + if (error_is_set(&errp)) { + error_free(errp); + errp = NULL; + } v = visitor_input_test_init(data, buf); visit_type_str(v, &sres, NULL, &errp); - g_free(sres); + if (error_is_set(&errp)) { + error_free(errp); + errp = NULL; + } else { + g_free(sres); + } v = visitor_input_test_init(data, buf); visit_type_EnumOne(v, &eres, NULL, &errp); + if (error_is_set(&errp)) { + error_free(errp); + errp = NULL; + } visitor_input_teardown(data, NULL); } } -- 1.7.11.4