Abort in mch_update_pciexbar

[Alexander Bulekov]

Hello,
While fuzzing, I found an input that triggers an assertion failure in
mch_update_pciexbar:

#6 0x7f38d387c55a in abort /build/glibc-GwnBeO/glibc-2.30/stdlib/abort.c:79:7
#7 0x55c27e94ffd0 in mch_update_pciexbar hw/pci-host/q35.c:331:9
#8 0x55c27e94db38 in mch_write_config hw/pci-host/q35.c:487:9
#9 0x55c27e9e3f4c in pci_host_config_write_common hw/pci/pci_host.c:81:5
#10 0x55c27e9e5307 in pci_data_write hw/pci/pci_host.c:118:5
#11 0x55c27e9e6601 in pci_host_data_write hw/pci/pci_host.c:165:9
#12 0x55c27ca3b17b in memory_region_write_accessor memory.c:496:5
#13 0x55c27ca3a5e4 in access_with_adjusted_size memory.c:557:18
#14 0x55c27ca38177 in memory_region_dispatch_write memory.c:1488:16
#15 0x55c27c721325 in flatview_write_continue exec.c:3174:23
#16 0x55c27c70994d in flatview_write exec.c:3214:14
#17 0x55c27c709462 in address_space_write exec.c:3305:18

I can reproduce it in a qemu 5.0 build using:
cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -M 
pc-q35-5.0 -display none -nodefaults -nographic -qtest stdio
outl 0xcf8 0xf2000060
outl 0xcfc 0x8400056e
EOF

I also uploaded the above trace, in case the formatting is broken:

curl https://paste.debian.net/plain/1146095 | qemu-system-i386 -M pc-q35-5.0 
-display none -nodefaults -nographic -qtest stdio

Please let me know if I can provide any further info.
-Alex