diff options
| author | Igor Mammedov <imammedo@redhat.com> | 2019-06-10 15:50:35 +0200 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2019-07-05 22:16:45 +0200 |
| commit | 58164eaff530a1e804f5710936dd37518ab5a90e (patch) | |
| tree | 116e79e17cc8ee51ace5f388aa1c181165234557 /hw/i386 | |
| parent | 39d1b92b810793e02558e05efa23059f67520bc9 (diff) | |
| download | qemu-58164eaff530a1e804f5710936dd37518ab5a90e.zip qemu-58164eaff530a1e804f5710936dd37518ab5a90e.tar.gz qemu-58164eaff530a1e804f5710936dd37518ab5a90e.tar.bz2 | |
pc: fix possible NULL pointer dereference in pc_machine_get_device_memory_region_size()
QEMU will crash when device-memory-region-size property is read if ms->device_memory
wasn't initialized yet.
Crash can be reproduced with:
$QEMU -preconfig -qmp unix:qmp_socket,server,nowait &
./scripts/qmp/qom-get -s qmp_socket /machine.device-memory-region-size
Instead of crashing return 0 if ms->device_memory hasn't been initialized.
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <1560174635-22602-1-git-send-email-imammedo@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/i386')
| -rw-r--r-- | hw/i386/pc.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/hw/i386/pc.c b/hw/i386/pc.c index e96360b..552f340 100644 --- a/hw/i386/pc.c +++ b/hw/i386/pc.c @@ -2458,7 +2458,11 @@ pc_machine_get_device_memory_region_size(Object *obj, Visitor *v, Error **errp) { MachineState *ms = MACHINE(obj); - int64_t value = memory_region_size(&ms->device_memory->mr); + int64_t value = 0; + + if (ms->device_memory) { + value = memory_region_size(&ms->device_memory->mr); + } visit_type_int(v, name, &value, errp); } |