From 801f15bdf1598a75f20d1c07d3e0640d37499165 Mon Sep 17 00:00:00 2001
From: David Sterba <dsterba@suse.com>
Date: Fri, 30 Sep 2016 16:23:05 +0200
Subject: [PATCH] btrfs-progs: tests: add fuzzed images with bad
 blocksize/lengh of eb

Signed-off-by: David Sterba <dsterba@suse.com>
---
 .../images/bko-166361-blocksize-zero.raw.txt       |  93 +++++++++++++++
 .../images/bko-166361-blocksize-zero.raw.xz        | Bin 0 -> 3840 bytes
 ...bko-169311-blocksize-zero-qgroup-verify.raw.txt | 126 +++++++++++++++++++++
 .../bko-169311-blocksize-zero-qgroup-verify.raw.xz | Bin 0 -> 3800 bytes
 4 files changed, 219 insertions(+)
 create mode 100644 tests/fuzz-tests/images/bko-166361-blocksize-zero.raw.txt
 create mode 100644 tests/fuzz-tests/images/bko-166361-blocksize-zero.raw.xz
 create mode 100644 tests/fuzz-tests/images/bko-169311-blocksize-zero-qgroup-verify.raw.txt
 create mode 100644 tests/fuzz-tests/images/bko-169311-blocksize-zero-qgroup-verify.raw.xz

diff --git a/tests/fuzz-tests/images/bko-166361-blocksize-zero.raw.txt b/tests/fuzz-tests/images/bko-166361-blocksize-zero.raw.txt
new file mode 100644
index 0000000..bca5296
--- /dev/null
+++ b/tests/fuzz-tests/images/bko-166361-blocksize-zero.raw.txt
@@ -0,0 +1,93 @@
+URL: https://bugzilla.kernel.org/show_bug.cgi?id=166361
+Lukas Lueg 2016-09-17 16:45:53 UTC
+
+More news from the fuzzer. The attached image causes a segmentation fault when
+running btrfsck over it; using btrfs-progs v4.7.1-17-g2076992
+
+The juicy parts:
+
+==30530==ERROR: AddressSanitizer: SEGV on unknown address 0x62103031ae21 (pc 0x0000005f19b9 bp 0x7ffd4aa30a90 sp 0x7ffd4aa30a90 T0)
+    #0 0x5f19b8 in btrfs_qgroup_status_flags /home/lukas/dev/btrfsfuzz/src-asan/./ctree.h:2136:1
+    #1 0x5f16f5 in read_qgroup_status /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:885:10
+    #2 0x5ef38a in load_quota_info /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:949:5
+    #3 0x5eeefc in qgroup_verify_all /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:1351:8
+    #4 0x51f08f in cmd_check /home/lukas/dev/btrfsfuzz/src-asan/cmds-check.c:11637:9
+    #5 0x4f0f81 in main /home/lukas/dev/btrfsfuzz/src-asan/btrfs.c:243:8
+    #6 0x7f7eb11aa730 in __libc_start_main (/lib64/libc.so.6+0x20730)
+    #7 0x4213f8 in _start (/home/lukas/dev/btrfsfuzz/bin-asan/bin/btrfs+0x4213f8)
+
+parent transid verify failed on 4198400 wanted 4 found 5
+Ignoring transid failure
+parent transid verify failed on 0 wanted 3472328296227680304 found 0
+parent transid verify failed on 0 wanted 3472328296227680304 found 0
+Ignoring transid failure
+parent transid verify failed on 4198400 wanted 26388280060160 found 5
+Ignoring transid failure
+parent transid verify failed on 0 wanted 3472328296227680304 found 0
+Ignoring transid failure
+checking extents
+parent transid verify failed on 0 wanted 3472328296227680304 found 0
+Ignoring transid failure
+parent transid verify failed on 0 wanted 3472328296227680304 found 0
+Ignoring transid failure
+parent transid verify failed on 0 wanted 3472328296227680304 found 0
+Ignoring transid failure
+parent transid verify failed on 0 wanted 3472328296227680304 found 0
+Ignoring transid failure
+parent transid verify failed on 0 wanted 3472328296227680304 found 0
+Ignoring transid failure
+parent transid verify failed on 0 wanted 3472328296227680304 found 0
+Ignoring transid failure
+parent transid verify failed on 0 wanted 3472328296227680304 found 0
+Ignoring transid failure
+parent transid verify failed on 0 wanted 3472328296227680304 found 0
+Ignoring transid failure
+Chunk[256, 228, 0]: length(4194304), offset(0), type(2) is not found in block group
+Chunk[256, 228, 0] stripe[1, 0] is not found in dev extent
+Chunk[256, 228, 4194304]: length(1638400), offset(4194304), type(5) is not found in block group
+Chunk[256, 228, 4194304] stripe[1, 4194304] is not found in dev extent
+Chunk[256, 228, 5832704]: length(1638400), offset(5832704), type(5) is not found in block group
+Chunk[256, 228, 5832704] stripe[1, 5832704] is not found in dev extent
+ref mismatch on [0 4096] extent item 0, found 1
+Backref 0 parent 0 root 0 not found in extent tree
+backpointer mismatch on [0 4096]
+ref mismatch on [131072 4096] extent item 0, found 1
+Backref 131072 parent 3 root 3 not found in extent tree
+backpointer mismatch on [131072 4096]
+ref mismatch on [4198400 4096] extent item 0, found 1
+Backref 4198400 parent 1 root 1 not found in extent tree
+backpointer mismatch on [4198400 4096]
+ref mismatch on [4231168 4096] extent item 0, found 1
+Backref 4231168 parent 7 root 7 not found in extent tree
+backpointer mismatch on [4231168 4096]
+ref mismatch on [3472328296227680304 3472328296227680304] extent item 0, found 1
+Backref 3472328296227680304 root 1 owner 2 offset 0 num_refs 0 not found in extent tree
+Incorrect local backref count on 3472328296227680304 root 1 owner 2 offset 0 found 1 wanted 0 back 0x60800000bda0
+backpointer mismatch on [3472328296227680304 3472328296227680304]
+Dev extent's total-byte(0) is not equal to byte-used(7471104) in dev[1, 216, 1]
+Errors found in extent allocation tree or chunk allocation
+parent transid verify failed on 0 wanted 3472328296227680304 found 0
+Ignoring transid failure
+parent transid verify failed on 4198400 wanted 26388280060160 found 5
+Ignoring transid failure
+checking free space cache
+checking fs roots
+root 5 root dir 3472328296227680304 not found
+checking csums
+checking root refs
+checking quota groups
+ASAN:DEADLYSIGNAL
+=================================================================
+==30530==ERROR: AddressSanitizer: SEGV on unknown address 0x62103031ae21 (pc 0x0000005f19b9 bp 0x7ffd4aa30a90 sp 0x7ffd4aa30a90 T0)
+    #0 0x5f19b8 in btrfs_qgroup_status_flags /home/lukas/dev/btrfsfuzz/src-asan/./ctree.h:2136:1
+    #1 0x5f16f5 in read_qgroup_status /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:885:10
+    #2 0x5ef38a in load_quota_info /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:949:5
+    #3 0x5eeefc in qgroup_verify_all /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:1351:8
+    #4 0x51f08f in cmd_check /home/lukas/dev/btrfsfuzz/src-asan/cmds-check.c:11637:9
+    #5 0x4f0f81 in main /home/lukas/dev/btrfsfuzz/src-asan/btrfs.c:243:8
+    #6 0x7f7eb11aa730 in __libc_start_main (/lib64/libc.so.6+0x20730)
+    #7 0x4213f8 in _start (/home/lukas/dev/btrfsfuzz/bin-asan/bin/btrfs+0x4213f8)
+
+AddressSanitizer can not provide additional info.
+SUMMARY: AddressSanitizer: SEGV /home/lukas/dev/btrfsfuzz/src-asan/./ctree.h:2136:1 in btrfs_qgroup_status_flags
+==30530==ABORTING
diff --git a/tests/fuzz-tests/images/bko-166361-blocksize-zero.raw.xz b/tests/fuzz-tests/images/bko-166361-blocksize-zero.raw.xz
new file mode 100644
index 0000000000000000000000000000000000000000..2b3c67411b867d08fc214ba9d718f3bf9c89b688
GIT binary patch
literal 3840
zcmeH~X*3iH8^;GT7%pQQh8m0|?vQmbAwon#_C0a4Butjl$YoNNvWHL@U00ZrAvMIE
zEaTd;4YFVRGKf-Xm>Ki-p7)%4-Vg7W-h0lyedzP^;d##Q{Qv*wd02WeZXN&taOF+C
z1t$Q(aTovq2o1QsX0tI|ZQcMxs!O>Lk6W7Re1y$ed!$~L1nT3Mpl|!KGu5XhTjj9`
z(XcMA`B9TxbBYsqvpoA6%$IZ0a>j7zBf_KuqfnvplE->6;+m+{XWN;`PtC#*t;1n!
z^1EP_g=*~uv9(&SirgUS7b;ygn2t<kEs6s^-R0ViGqm;VaVCLMO3c!{H^$tG4hibO
z=}+q52{wqZMQF!X?TA?oyoPIIwY1!wdp$jSqI_@{Wo#6=OJ(wiHiF|OPg>aNU1Ks^
zaI&sC$u6V#v1y?_PsX5N?wvC^4!hW4!5V%G75LHikXy%rIa~#oK+Q~Zbh)dcx%_>2
z+pKWS`Vi0JsDNvXK;pe=Tsmtn9!-*ZAKyOc+tpRKv-Iv+I>4*WcmLJ$06CG&ZGdDx
zv=967aQ$s-Zhj540kSKR7I+9)x?Zg;z%?|Oh2NpdmQJr)9ld*xnl=)D<j$c%Xw#Y{
zxx~jXVbeTT@@g&8TOXqMQ;6}t2{8F>vMy+$cT(`!FbSdWxD%8T4=B`5SNruWJ9D6m
znE7ng*7J1i8&r|HGxk77le7d?<gM$e#P4T>@F&|ezd_hu(}0aVxNcB-y$64iu6OkO
z%tl1rlEtpmyOb-c8dGg&owDWfxw(A0FB^!pXz3M{LpjRV%D~7?0^8%rlZYS0?^ckH
zWh%^HE~$|B*;MXL9Lg)W6Nk*+QM&S3vW2_ArhqkGGnxgVC_2(VW$S8!%86T;*2^}h
zei+IYCJ59v>))pDN8a2S!Pr(|YEQs{QsEKg<&(n2*=NVb;_>Lo?yiVj0V*#F4X6wp
zL1GV7K-i!vE~2H;skc*F5|s7fr=?AY=Vwgh6x?qWme6t*5@`5Wjr8IvVzgrqV?Ai)
z-XZBxh4ZV)(GL}A%blIlVBi(;;%K1;iM(jq@+{_baH^d4XbyjF1I$(GsdZts=zHaW
zo6y`5vkt52X}^V!BSbZ@iH%fp^oiI6SHJQHcCb*h;=YdbxYh>gDb)bPW9l$x4e$Jb
zim)#V5#8cMT)ZNc2T`~!eRl=hL>pNE6COR<?uhxFyYQE=+>Bn1#)nubfpA218Y^tu
zyYbWlWGx0xJ!<VAVzB2uvt2skQbht(>zCb57Gw+M(8I5})A{?@dCC@$DrW2-jQbjD
zE-jgfA8y`g@&DgUtIxw<_SY)Gyxfy$0S<0t+SMoSOUs@h-o4JrY9_-$C8|%_Q`U5E
z#_>4)#|vNsTrV<Y_PN13%5Q46U;#9qEySS;c&k+Az8e73t-B!`t2>#KzdHi$ZR<rf
z1#8vDg<FL4%5#K@x}xl)@#Lqmno@XDx@Oq_r+~jOtq%cWWF26dCHnV+`m;4ZTQU^S
zUgK&97_AGHF52#Q!|l=|B9F~+_@|1rElHkZW$d%I9WL}$vVJC^%S_{SO-|Kj0)X}F
z!{p#bkzw67eK6m^PugB+$(~zmBhh6YRE%%1J?uHq8tR5B@g9hm>^7TLh7o69l$~jM
zx3DX|5->=Xx#XPC)gkM&J%z2TS1jMyi;C^Z<niZG*wbb{ru;l_CpNBCl^7<t#AiD8
z61~;EOgWdyky5{nyFcElg>q~RCip$8jxQR>id*y;8?t~I<UDw8y4}79y}=dC$B)}*
z<<5%UVG=?ZvaobM2MatkzUhVYC+fWA=b6pXKi)G-KJ;H5XP2{H7wZ8l?&RL`cI#Gd
z;3;#uYghrHYBu`$u(Q0N4-Z9UNNT3lLfxKPy-mxQHl0JLFB}bKq|OJa<=;;&l1k_~
z!_$RwU`N$lr5qFmTSdwWxFwkDO|f=&e|JQ+&olczWE$-aUoqe9`{c$izLJmJy1d13
z)hpU~g@&_R!olJMGtkh~g?UD~87Vs1NaD!c#0nKby<L$UVoa%X*uYd49N#Qd%8l@y
zv6mJ&UgoofX@T)axtW2sVPZPaiUK_{huupOQEHZRqqW*{33bvkyc;0sOVP+b?V>1r
zj@BwJfxS2ke2GECm>hU>vk8Ul_PN#Yi&eaVA3TI(l@28tQQCRz7;=&F89ZVp(cpW9
zE;Ofp`L@17%ye|efS(Q=IpM7T+GyU2ko2wrJy#H$R3kz+lGE-Fg?PaAJ6|LTnGQs2
z`Ep5+B<A?+Cf47&jH%H>xqrcByoW5l@Lv^Y1a{*2O~siqFlR4A`Y<HRtZE-kI{a`0
zG#;7_3RQjJQ53F@uX}XXqwK&ENzA&uTREq<Q3Z~TNpXZRGwX0+%ap-35M*3lXsEg&
zV7zT#M?GnxInG$w2#PBp{FnLv)bu}Sr+==s2uMNsKhd`t=~%(~Mq({53fBM*mIVqE
zzP+5}XcV~gZ(=HdZ;9C7yfMGVH1-hVy6?cgVrhQ|_T?t~uCT8>V!sv`j{5`v1o(9|
ovUuXlFWU?G+>cazY60MwgyV2HUVl*iP%R~p!TF^I0J?kp3!{*7G5`Po

literal 0
HcmV?d00001

diff --git a/tests/fuzz-tests/images/bko-169311-blocksize-zero-qgroup-verify.raw.txt b/tests/fuzz-tests/images/bko-169311-blocksize-zero-qgroup-verify.raw.txt
new file mode 100644
index 0000000..c3d491b
--- /dev/null
+++ b/tests/fuzz-tests/images/bko-169311-blocksize-zero-qgroup-verify.raw.txt
@@ -0,0 +1,126 @@
+URL: https://bugzilla.kernel.org/show_bug.cgi?id=169311
+Lukas Lueg 2016-09-18 09:23:44 UTC
+
+More news from the fuzzer. The attached image causes a heap-buffer-overflow
+when running btrfsck with ASAN over it; using btrfs-prog s v4.7.2-56-ge8c2013
+
+
+==32491==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c00000bf5c at pc 0x000000614b63 bp 0x7ffeacb5c3b0 sp 0x7ffeacb
+5c3a8
+READ of size 8 at 0x60c00000bf5c thread T0
+    #0 0x614b62 in crc32c_intel /home/lukas/dev/btrfsfuzz/src-asan/crc32c.c:75:19
+    #1 0x614c09 in crc32c_le /home/lukas/dev/btrfsfuzz/src-asan/crc32c.c:221:9
+    #2 0x58de58 in __csum_tree_block_size /home/lukas/dev/btrfsfuzz/src-asan/disk-io.c:139:8
+    #3 0x58dd88 in csum_tree_block_size /home/lukas/dev/btrfsfuzz/src-asan/disk-io.c:159:9
+    #4 0x58dfa1 in csum_tree_block_fs_info /home/lukas/dev/btrfsfuzz/src-asan/disk-io.c:174:9
+    #5 0x58eb64 in read_tree_block_fs_info /home/lukas/dev/btrfsfuzz/src-asan/disk-io.c:348:19
+    #6 0x5f2f84 in read_tree_block /home/lukas/dev/btrfsfuzz/src-asan/./disk-io.h:112:9
+    #7 0x5f2d62 in travel_tree /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:692:7
+    #8 0x5f2bab in add_refs_for_implied /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:748:8
+    #9 0x5eff59 in map_implied_refs /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:766:9
+    #10 0x5eefa9 in qgroup_verify_all /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:1366:8
+    #11 0x51f08f in cmd_check /home/lukas/dev/btrfsfuzz/src-asan/cmds-check.c:11637:9
+    #12 0x4f0f81 in main /home/lukas/dev/btrfsfuzz/src-asan/btrfs.c:243:8
+    #13 0x7fbf35742730 in __libc_start_main (/lib64/libc.so.6+0x20730)
+    #14 0x4213f8 in _start (/home/lukas/dev/btrfsfuzz/bin-asan/bin/btrfs+0x4213f8)
+
+checking extents
+Chunk[256, 228, 0]: length(4194304), offset(0), type(2) is not found in block group
+Chunk[256, 228, 0] stripe[1, 0] is not found in dev extent
+Chunk[256, 228, 4194304]: length(1638400), offset(4194304), type(5) is not found in block group
+Chunk[256, 228, 4194304] stripe[1, 4194304] is not found in dev extent
+Chunk[256, 228, 5832704]: length(1638400), offset(5832704), type(5) is not found in block group
+Chunk[256, 228, 5832704] stripe[1, 5832704] is not found in dev extent
+ref mismatch on [131072 4096] extent item 0, found 1
+Backref 131072 parent 3 root 3 not found in extent tree
+backpointer mismatch on [131072 4096]
+ref mismatch on [4194304 4096] extent item 0, found 1
+Backref 4194304 parent 5 root 5 not found in extent tree
+backpointer mismatch on [4194304 4096]
+ref mismatch on [4198400 4096] extent item 0, found 1
+Backref 4198400 parent 1 root 1 not found in extent tree
+backpointer mismatch on [4198400 4096]
+ref mismatch on [4231168 4096] extent item 0, found 1
+Backref 4231168 parent 7 root 7 not found in extent tree
+backpointer mismatch on [4231168 4096]
+ref mismatch on [3472328296227680304 3472328296227680304] extent item 0, found 1
+Backref 3472328296227680304 root 1 owner 2 offset 0 num_refs 0 not found in extent tree
+Incorrect local backref count on 3472328296227680304 root 1 owner 2 offset 0 found 1 wanted 0 back 0x60800000bc20
+backpointer mismatch on [3472328296227680304 3472328296227680304]
+Dev extent's total-byte(0) is not equal to byte-used(7471104) in dev[1, 216, 1]
+Errors found in extent allocation tree or chunk allocation
+checking free space cache
+checking fs roots
+checking csums
+checking root refs
+checking quota groups
+=================================================================
+==32491==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c00000bf5c at pc 0x000000614b63 bp 0x7ffeacb5c3b0 sp 0x7ffeacb5c3a8
+READ of size 8 at 0x60c00000bf5c thread T0
+    #0 0x614b62 in crc32c_intel /home/lukas/dev/btrfsfuzz/src-asan/crc32c.c:75:19
+    #1 0x614c09 in crc32c_le /home/lukas/dev/btrfsfuzz/src-asan/crc32c.c:221:9
+    #2 0x58de58 in __csum_tree_block_size /home/lukas/dev/btrfsfuzz/src-asan/disk-io.c:139:8
+    #3 0x58dd88 in csum_tree_block_size /home/lukas/dev/btrfsfuzz/src-asan/disk-io.c:159:9
+    #4 0x58dfa1 in csum_tree_block_fs_info /home/lukas/dev/btrfsfuzz/src-asan/disk-io.c:174:9
+    #5 0x58eb64 in read_tree_block_fs_info /home/lukas/dev/btrfsfuzz/src-asan/disk-io.c:348:19
+    #6 0x5f2f84 in read_tree_block /home/lukas/dev/btrfsfuzz/src-asan/./disk-io.h:112:9
+    #7 0x5f2d62 in travel_tree /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:692:7
+    #8 0x5f2bab in add_refs_for_implied /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:748:8
+    #9 0x5eff59 in map_implied_refs /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:766:9
+    #10 0x5eefa9 in qgroup_verify_all /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:1366:8
+    #11 0x51f08f in cmd_check /home/lukas/dev/btrfsfuzz/src-asan/cmds-check.c:11637:9
+    #12 0x4f0f81 in main /home/lukas/dev/btrfsfuzz/src-asan/btrfs.c:243:8
+    #13 0x7fbf35742730 in __libc_start_main (/lib64/libc.so.6+0x20730)
+    #14 0x4213f8 in _start (/home/lukas/dev/btrfsfuzz/bin-asan/bin/btrfs+0x4213f8)
+
+0x60c00000bf5c is located 28 bytes to the right of 128-byte region [0x60c00000bec0,0x60c00000bf40)
+allocated by thread T0 here:
+    #0 0x4bfd40 in calloc (/home/lukas/dev/btrfsfuzz/bin-asan/bin/btrfs+0x4bfd40)
+    #1 0x5c181a in __alloc_extent_buffer /home/lukas/dev/btrfsfuzz/src-asan/extent_io.c:542:7
+    #2 0x5c1c76 in alloc_extent_buffer /home/lukas/dev/btrfsfuzz/src-asan/extent_io.c:646:8
+    #3 0x58e01c in btrfs_find_create_tree_block /home/lukas/dev/btrfsfuzz/src-asan/disk-io.c:193:9
+    #4 0x58ea90 in read_tree_block_fs_info /home/lukas/dev/btrfsfuzz/src-asan/disk-io.c:339:7
+    #5 0x5f2f84 in read_tree_block /home/lukas/dev/btrfsfuzz/src-asan/./disk-io.h:112:9
+    #6 0x5f2d62 in travel_tree /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:692:7
+    #7 0x5f2bab in add_refs_for_implied /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:748:8
+    #8 0x5eff59 in map_implied_refs /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:766:9
+    #9 0x5eefa9 in qgroup_verify_all /home/lukas/dev/btrfsfuzz/src-asan/qgroup-verify.c:1366:8
+    #10 0x51f08f in cmd_check /home/lukas/dev/btrfsfuzz/src-asan/cmds-check.c:11637:9
+    #11 0x4f0f81 in main /home/lukas/dev/btrfsfuzz/src-asan/btrfs.c:243:8
+    #12 0x7fbf35742730 in __libc_start_main (/lib64/libc.so.6+0x20730)
+
+SUMMARY: AddressSanitizer: heap-buffer-overflow /home/lukas/dev/btrfsfuzz/src-asan/crc32c.c:75:19 in crc32c_intel
+Shadow bytes around the buggy address:
+  0x0c187fff9790: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+  0x0c187fff97a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+  0x0c187fff97b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+  0x0c187fff97c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+  0x0c187fff97d0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
+=>0x0c187fff97e0: 00 00 00 00 00 00 00 00 fa fa fa[fa]fa fa fa fa
+  0x0c187fff97f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
+  0x0c187fff9800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+  0x0c187fff9810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+  0x0c187fff9820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+  0x0c187fff9830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+Shadow byte legend (one shadow byte represents 8 application bytes):
+  Addressable:           00
+  Partially addressable: 01 02 03 04 05 06 07 
+  Heap left redzone:       fa
+  Heap right redzone:      fb
+  Freed heap region:       fd
+  Stack left redzone:      f1
+  Stack mid redzone:       f2
+  Stack right redzone:     f3
+  Stack partial redzone:   f4
+  Stack after return:      f5
+  Stack use after scope:   f8
+  Global redzone:          f9
+  Global init order:       f6
+  Poisoned by user:        f7
+  Container overflow:      fc
+  Array cookie:            ac
+  Intra object redzone:    bb
+  ASan internal:           fe
+  Left alloca redzone:     ca
+  Right alloca redzone:    cb
+==32491==ABORTING
diff --git a/tests/fuzz-tests/images/bko-169311-blocksize-zero-qgroup-verify.raw.xz b/tests/fuzz-tests/images/bko-169311-blocksize-zero-qgroup-verify.raw.xz
new file mode 100644
index 0000000000000000000000000000000000000000..c506d1bc52c11325b80f197d6e13c2d60b1c8bfd
GIT binary patch
literal 3800
zcmeH~S5(sp7RLWbD3PiJfk4m*3=EMXT@WEuDWL@^0s|I`)DT6ANFof2fb=5ZNa7%!
zK!T0|i7`?n5FA<nrKkiDl0k7$99qoIyv)-+=<YeY59{-NxcB_d_kH(XzG;fzX#fDd
znY{0?2Y?Hy001C6>^CG3#0hr?0q|U(T3Io_8%O4`C=X9<(?SKKk5kfTdX`R&1v82e
z&HKs6+tX-uU59Dcy}_%sMM;Wh_Dr9gJ3jgmj_iw5uSYx-b6LP9$vOSuHg|D@wok@D
zC3Z#a6BxlE8FC;il)(DZ2-OD&CMvG4K+B-li;(A&bj_8^yOM?shidK;%O<TvHN4XG
zK(iZq;1>dsrgu#}$&Kp}r{N)(VX}dN|0z~Lz~H4|{Dp%k4N>C3GBQf~IkJTz$YV|&
zd<UbO=uzGCZ#UaidWz+bNSEfgmUw+i9+z&Da6rIxdZK@{1eFL^M2XOL?agX^kK3zN
z!Mb1VYvYZIElf!HrbuO$&*Jm=TR1Z+^mkm($QdTHeSPu$y*wbW{mk~`rD1v|UDQH*
z_l{@m_bT_ZT|_1H%`CK;ncQ$?5RpgHk`f*rDI~0q9U{&yJLwdckKJJ7zROV_k?&eL
zNv{q*p1x|Is&tv69b_(}aW2|w8wtvKn`I)xVNFXP8>hm}(d!Y{aX_VEp6*=_LBTMS
zTySsMEx<W-(&#6>Q^}u=k5U)qHN@Ko8wlI^(GpoG+9cd9Nndg5))foll|h2trm0TI
z+;7<SMTbw`@2@8u(Vyw|@Gd%hQ&c#30Am4R7?@Vn$_v%5)PS{Dn*^u7Yr#q$D6Xd;
zD^Q=uRM)EouWGR}N6RX5(zJ`#H52|&Vu)6tD)`UaCJJSGHPD+IMJ7i@YRT{7o?uXp
zlA}fYnxrT+^X$#-iy7<eIJd?)iZu)bjmOfL?DpL*@|c>!5zM9snAlROF>xa^pdp;C
zo%|Ugk{r<}Og?$S@$HO(LN9N;mDr^+KZiW5?*C(DHMfM5&LuqV+`K(QPDBsx@FL!n
zE2~bZhb(6$-qGML_4liSK?w(LC(3pxlqGVPUd1^_<{mbjD3K`bQ1peix>S<ne%A`i
zkS}H1_BqYYp5=UGlXbyJ6f`T*IyK$*Z0#*~#TeV$&-(Jxo^+_r90`LrkB#qX6Q3VO
z>^oxwPh@zL7ZRXlGV0l?#cz_kxNHu%sjhCVFXgFd<<GID`7EK%JIPR~csS_>KXxss
z(~%>yk^&pkaS4sK*b16kBeH!OsQ}5mCOb=7AX~B-pX9$O@k~&r<sj3zoBDF6N?+H9
zQIPo|;~FFMUo$0zz#jfe(Nqld{|7hB%a6{z+~U8u6d)qL)jv(z-SI+PdZrq1$YyH}
zZMpgVd9VeZr5*k17mN43k96I@Qf35!tk4nQt!9n?r!Ym6_G^byO{Pn3eqzhBx>-hD
zkp`5sc!zj#HK7<eUn6%_0=+f$D3n0WI~x1%Dd0btHn>UVgiDxBq1=BT)ZeWo1WGXk
z!HV!L-~>;WxZt)u0CUg7UOe_%C^UC}_oC7d{QPbHn%DVf4g9NAvl<(m3DS{L0D$iE
z#_5rr`^QbX%|Yv-jYLlF<2x9AOPgvgDPvotA@tR@H3j+HmCDr#3wx=qn8JOez^V=x
zgG+LpQxj^3rgWv#b+3HRd7bj8*!S*1`x?fO<T(}1>4~)F0BWyg_f1}5nQC>qx9eVl
z*XLsPf|D2X*Re8QyK3Z<=EvNJw)m{&D%pks_2F}RFj^hmEozC}0*>Z%<!D;W+i8@u
zh~R0?<@<5we3QD9=`OCGgxBL4RWcv?$2|=0B;pX6gVS1r_h5KaW{>uUe0(KCOkGUb
zHnnkd2j0w%IyvuB9;?6|Aa#;v)%$uN#^+Hgqmd~RuZE1nLj$(nDdfY&_pZK&igq(=
zieLNe4M5MIz;Rxq9Vus*{V@9G(Gj%T3*9(5$!M(IhlPg{H<l7M{MsTroO9w^R^qj|
zzI~C0RwFGBxWuwbT0@W>F-nq9=&hKcP{$$S)?N%3Qg}~28BporedaHVJXJX0?aVwp
zrFTft(A~G~!G(VD1%JQGL5xPF{KAg>;h7BYYVR94&(9qz>UC8at(1vSBSVVVZR=AE
zjJ9&wZj><2EAhi>u4Le20hm6hXX-40`k9PLj$7<692v;YHu9A4?BEHV^^><kgv<^^
z%QdX`_THie;`Y361g=M!(;m^Io=RgOHt{^KP=2Q>%GMJ*&%MZJv>~Hr-wd;MoX}Ut
ztPugVw&-65uC1vMnuwT780&I;<VWK`V_!FT+fALHkV8-PT(Fl`+V{^C4#7PQpS8#y
zf1*^m)(WwqT(HkiQt}C!X?T(;wp;)7h24XYw{@78Za*YyRqd_tj-ARKylxeIbcgA_
zB4<fmz&})L*c8ouv4NYEQntF9*qi}@$Bs^<d^iC?pZ)Tr_}c*gL+^c2>)*`SHGf4K
z0$9C>uIK-s$JG}g^OUh_{|4+UR?9bFe_jq>lLy~`eFOIOx9Qg^3@>U8hyZt&GT)i}
l`Jw`9y&vIj%~f`Q5Cw+E<HdKkv+hxP!*}-lRRsB;{wJ&&Vu1hv

literal 0
HcmV?d00001

-- 
2.7.4