aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLaurent Vivier <laurent@vivier.eu>2022-01-07 11:50:49 +0100
committerLaurent Vivier <laurent@vivier.eu>2022-01-09 12:03:21 +0100
commit0969e00b3933a10a481f5bc13c834bf1abbc438d (patch)
treea891afb6ece48aedd585d971e23d5955e472df1c
parent214bdf8e7199a34fe6f46ac7a83b61d8cc3f8ad0 (diff)
q800: fix segfault with invalid MacROM
"qemu-system-m68k -M q800 -bios /dev/null" crashes with a segfault in q800_init(). This happens because the code doesn't check that rom_ptr() returned a non-NULL pointer . To avoid NULL pointer, don't allow 0 sized file and use bios_size with rom_ptr(). Resolves: https://gitlab.com/qemu-project/qemu/-/issues/756 Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20220107105049.961489-1-laurent@vivier.eu> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
-rw-r--r--hw/m68k/q800.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index e4c7c9b88a..55dfe5036f 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -672,12 +672,13 @@ static void q800_init(MachineState *machine)
/* Remove qtest_enabled() check once firmware files are in the tree */
if (!qtest_enabled()) {
- if (bios_size < 0 || bios_size > MACROM_SIZE) {
+ if (bios_size <= 0 || bios_size > MACROM_SIZE) {
error_report("could not load MacROM '%s'", bios_name);
exit(1);
}
- ptr = rom_ptr(MACROM_ADDR, MACROM_SIZE);
+ ptr = rom_ptr(MACROM_ADDR, bios_size);
+ assert(ptr != NULL);
stl_phys(cs->as, 0, ldl_p(ptr)); /* reset initial SP */
stl_phys(cs->as, 4,
MACROM_ADDR + ldl_p(ptr + 4)); /* reset initial PC */