diff options
| author | Igor Mammedov <imammedo@redhat.com> | 2019-06-24 05:02:00 -0400 |
|---|---|---|
| committer | Eduardo Habkost <ehabkost@redhat.com> | 2019-07-05 17:08:03 -0300 |
| commit | fc3b77e20d002fb434be726f2328a17fd5edecb7 (patch) | |
| tree | 306bae2111f4997354cccb2d746872a72c3db23c /hw | |
| parent | d65af288a84d8bf8c27e55d45545f52f016c08a7 (diff) | |
pc: fix possible NULL pointer dereference in pc_machine_get_device_memory_region_size()
QEMU will crash when device-memory-region-size property is read if ms->device_memory
wasn't initialized yet.
Crash can be reproduced with:
$QEMU -preconfig -qmp unix:qmp_socket,server,nowait &
./scripts/qmp/qom-get -s qmp_socket /machine.device-memory-region-size
Instead of crashing return 0 if ms->device_memory hasn't been initialized.
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20190624090200.5383-1-imammedo@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/i386/pc.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/hw/i386/pc.c b/hw/i386/pc.c index e8378f6a0a..2107532d12 100644 --- a/hw/i386/pc.c +++ b/hw/i386/pc.c @@ -2553,7 +2553,11 @@ pc_machine_get_device_memory_region_size(Object *obj, Visitor *v, Error **errp) { MachineState *ms = MACHINE(obj); - int64_t value = memory_region_size(&ms->device_memory->mr); + int64_t value = 0; + + if (ms->device_memory) { + value = memory_region_size(&ms->device_memory->mr); + } visit_type_int(v, name, &value, errp); } |