2 Commits (ca1e23093e047cc14486d7de647e238e4020b7f2)

Author	SHA1	Message	Date
Michael Richters	ca1e23093e	Move QueueLeaker plugin testcases to a separate directory ... This makes room for a Qukeys testcase that also triggers the bug. Signed-off-by: Michael Richters <gedankenexperimenter@gmail.com>	3 years ago
Michael Richters	4480b08b2d	Add testcase for KeyAddrEventQueue bounds checking failure ... `KeyAddrEventQueue::remove()` fails to confirm that the current queue is empty before decrementing the length and shifting entries in the queue arrays. If `remove()` or `shift()` is called when the queue is empty, `length_` gets decremented from 0 to 255 (because it's unsigned), and then a large section of memory gets shifted, mostly out of bounds of the event queue arrays, and probably wreaking havoc with any number of things. The plugin in this testcase should trigger this bug, and is detectable because it affects the value for the current time. It's not guaranteed to detect this bug, but it seems to be fairly consistent. Signed-off-by: Michael Richters <gedankenexperimenter@gmail.com>	3 years ago