From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42112) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VnsnT-0006Ss-OL for qemu-devel@nongnu.org; Tue, 03 Dec 2013 11:26:09 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VnsnN-0006ud-GI for qemu-devel@nongnu.org; Tue, 03 Dec 2013 11:26:03 -0500 Date: Tue, 3 Dec 2013 18:29:26 +0200 From: "Michael S. Tsirkin" Message-ID: <1386087086-3691-24-git-send-email-mst@redhat.com> References: <1386087086-3691-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1386087086-3691-1-git-send-email-mst@redhat.com> Subject: [Qemu-devel] [PATCH 23/23] savevm: fix potential segfault on invalid state List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org savevm will segfault if version_id < vmsd->minimum_version_id && version_id >= vmsd->minimum_version_id_old This calls through a NULL pointer. This is a bug (should exit not crash). Signed-off-by: Michael S. Tsirkin --- savevm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/savevm.c b/savevm.c index 3f912dd..04349f6 100644 --- a/savevm.c +++ b/savevm.c @@ -1686,6 +1686,9 @@ int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd, return -EINVAL; } if (version_id < vmsd->minimum_version_id) { + if (!vmsd->load_state_old) { + return -EINVAL; + } return vmsd->load_state_old(f, opaque, version_id); } if (vmsd->pre_load) { -- MST