diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2019-04-25 12:05:34 +0530 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2019-05-07 09:11:27 +0200 |
| commit | d52680fc932efb8a2f334cc6993e705ed1e31e99 (patch) | |
| tree | 178da96cccb789d9fc341bef899dc57438f7ac60 /hw/display/qxl.c | |
| parent | a6ae23831b05a11880b40f7d58e332c45a6b04f7 (diff) | |
| download | qemu-d52680fc932efb8a2f334cc6993e705ed1e31e99.zip qemu-d52680fc932efb8a2f334cc6993e705ed1e31e99.tar.gz qemu-d52680fc932efb8a2f334cc6993e705ed1e31e99.tar.bz2 | |
qxl: check release info object
When releasing spice resources in release_resource() routine,
if release info object 'ext.info' is null, it leads to null
pointer dereference. Add check to avoid it.
Reported-by: Bugs SysSec <bugs-syssec@rub.de>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20190425063534.32747-1-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/display/qxl.c')
| -rw-r--r-- | hw/display/qxl.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/hw/display/qxl.c b/hw/display/qxl.c index c8ce578..632923a 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -777,6 +777,9 @@ static void interface_release_resource(QXLInstance *sin, QXLReleaseRing *ring; uint64_t *item, id; + if (!ext.info) { + return; + } if (ext.group_id == MEMSLOT_GROUP_HOST) { /* host group -> vga mode update request */ QXLCommandExt *cmdext = (void *)(intptr_t)(ext.info->id); |