5 Commits (f28a847329db238ea5ac3b370303cdee66d92073)

Author	SHA1	Message	Date
Michael Richters	e5d67efd58	Format codebase with `clang-format` ... Signed-off-by: Michael Richters <gedankenexperimenter@gmail.com>	3 years ago
Michael Richters	e31fe2be10	Add Qukeys testcase for #1107 ... This is closer to a real-world scenario than the QueueLeaker plugin testcase. It doesn't test the bug as deliberately, but it shows the failure of Qukeys prior to the fix. Signed-off-by: Michael Richters <gedankenexperimenter@gmail.com>	3 years ago
Michael Richters	b68ea18212	Reduce code repetition in testcase for #1107 ... Signed-off-by: Michael Richters <gedankenexperimenter@gmail.com>	3 years ago
Michael Richters	ca1e23093e	Move QueueLeaker plugin testcases to a separate directory ... This makes room for a Qukeys testcase that also triggers the bug. Signed-off-by: Michael Richters <gedankenexperimenter@gmail.com>	3 years ago
Michael Richters	4480b08b2d	Add testcase for KeyAddrEventQueue bounds checking failure ... `KeyAddrEventQueue::remove()` fails to confirm that the current queue is empty before decrementing the length and shifting entries in the queue arrays. If `remove()` or `shift()` is called when the queue is empty, `length_` gets decremented from 0 to 255 (because it's unsigned), and then a large section of memory gets shifted, mostly out of bounds of the event queue arrays, and probably wreaking havoc with any number of things. The plugin in this testcase should trigger this bug, and is detectable because it affects the value for the current time. It's not guaranteed to detect this bug, but it seems to be fairly consistent. Signed-off-by: Michael Richters <gedankenexperimenter@gmail.com>	3 years ago