From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:35765) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Tfeo7-0007gg-89 for qemu-devel@nongnu.org; Mon, 03 Dec 2012 17:48:13 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Tfeo6-0003FH-2l for qemu-devel@nongnu.org; Mon, 03 Dec 2012 17:48:11 -0500 Sender: fluxion From: Michael Roth Date: Mon, 3 Dec 2012 16:44:30 -0600 Message-Id: <1354574681-28954-1-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1354572547-21271-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1354572547-21271-1-git-send-email-mdroth@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PATCH 33/43] qapi: handle visitor->type_size() in QapiDeallocVisitor List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-stable@nongnu.org Cc: aliguori@us.ibm.com, qemu-devel@nongnu.org From: Stefan Hajnoczi visit_type_size() requires either visitor->type_size() or visitor_uint64() to be implemented, otherwise a NULL function pointer is invoked. It is possible to trigger this crash as follows: $ qemu-system-x86_64 -netdev tap,sndbuf=0,id=netdev0 \ -device virtio-blk-pci,netdev=netdev0 The 'sndbuf' option has type "size". Reviewed-by: Andreas Färber Reviewed-by: Michael Roth Signed-off-by: Stefan Hajnoczi Signed-off-by: Anthony Liguori (cherry picked from commit 0c26f2eca40d6c65ea9edc62a10e510dc7f65cc8) Signed-off-by: Michael Roth --- qapi/qapi-dealloc-visitor.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/qapi/qapi-dealloc-visitor.c b/qapi/qapi-dealloc-visitor.c index a154523..a07b171 100644 --- a/qapi/qapi-dealloc-visitor.c +++ b/qapi/qapi-dealloc-visitor.c @@ -132,6 +132,11 @@ static void qapi_dealloc_type_number(Visitor *v, double *obj, const char *name, { } +static void qapi_dealloc_type_size(Visitor *v, size_t *obj, const char *name, + Error **errp) +{ +} + static void qapi_dealloc_type_enum(Visitor *v, int *obj, const char *strings[], const char *kind, const char *name, Error **errp) @@ -164,6 +169,7 @@ QapiDeallocVisitor *qapi_dealloc_visitor_new(void) v->visitor.type_bool = qapi_dealloc_type_bool; v->visitor.type_str = qapi_dealloc_type_str; v->visitor.type_number = qapi_dealloc_type_number; + v->visitor.type_size = qapi_dealloc_type_size; QTAILQ_INIT(&v->stack); -- 1.7.9.5