[Qemu-devel] [PATCH for-1.2] libcacard: Fix segfault when no backend specified

[Qemu-devel] [PATCH for-1.2] libcacard: Fix segfault when no backend specified

[Michael Roth]

When a user does not specify a backend, a segfault can be triggered due
to a strcmp() being called on a NULL char*:

$ gdb --args qemu -usb -device usb-ccid \
                  -device ccid-card-emulated,id=smartcard0 \
                  ...

(gdb) s
emulated_initfn (base=0x555556cb2e70) at
/home/mdroth/w/qemu.git/hw/ccid-card-emulated.c:503
503     card->backend = parse_enumeration(card->backend_str,
backend_enum_table, 0);
(gdb) s
parse_enumeration (not_found_value=0, table=0x555555b9b3c0, str=0x0) at
/home/mdroth/w/qemu.git/hw/ccid-card-emulated.c:476
476     while (table->name != NULL) {
(gdb) s
477         if (strcmp(table->name, str) == 0) {
(gdb) s
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff60df09a in ?? () from /lib/x86_64-linux-gnu/libc.so.6

After the fix:

$ qemu -usb -device usb-ccid \
     -device ccid-card-emulated,id=smartcard0 \
     ...
unknown backend, must be one of:
nss-emulated
certificates
qemu-system-x86_64: -device
ccid-card-emulated,id=smartcard0,backend=nss-certificates: Device
'ccid-card-emulated' could not be initialized

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---
 hw/ccid-card-emulated.c |    3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/ccid-card-emulated.c b/hw/ccid-card-emulated.c
index f4a6da4..740e8df 100644
--- a/hw/ccid-card-emulated.c
+++ b/hw/ccid-card-emulated.c
@@ -473,6 +473,9 @@ static uint32_t parse_enumeration(char *str,
 {
     uint32_t ret = not_found_value;
 
+    if (!str) {
+        return ret;
+    }
     while (table->name != NULL) {
         if (strcmp(table->name, str) == 0) {
             ret = table->value;
-- 
1.7.9.5