From 660a2d83e026496db6b3eaec2256a2cdd6c74de8 Mon Sep 17 00:00:00 2001 From: "Daniel P. Berrange" Date: Fri, 30 Sep 2016 16:02:01 +0100 Subject: char: fix missing return in error path for chardev TLS init If the qio_channel_tls_new_(server|client) methods fail, we disconnect the client. Unfortunately a missing return means we then go on to try and run the TLS handshake on a NULL I/O channel. This gives predictably segfaulty results. The main way to trigger this is to request a bogus TLS priority string for the TLS credentials. e.g. -object tls-creds-x509,id=tls0,priority=wibble,... Most other ways appear impossible to trigger except perhaps if OOM conditions cause gnutls initialization to fail. Signed-off-by: Daniel P. Berrange Reviewed-by: Eric Blake Signed-off-by: Michael Tokarev --- qemu-char.c | 1 + 1 file changed, 1 insertion(+) (limited to 'qemu-char.c') diff --git a/qemu-char.c b/qemu-char.c index fb456cec34..48a45ef583 100644 --- a/qemu-char.c +++ b/qemu-char.c @@ -3132,6 +3132,7 @@ static void tcp_chr_tls_init(CharDriverState *chr) if (tioc == NULL) { error_free(err); tcp_chr_disconnect(chr); + return; } object_unref(OBJECT(s->ioc)); s->ioc = QIO_CHANNEL(tioc); -- cgit v1.2.3