From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56591) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aYAcR-0002qT-Rp for qemu-devel@nongnu.org; Tue, 23 Feb 2016 05:55:04 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aYAcQ-000244-NY for qemu-devel@nongnu.org; Tue, 23 Feb 2016 05:55:03 -0500 Received: from mx1.redhat.com ([209.132.183.28]:34832) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aYAcQ-00023i-Ir for qemu-devel@nongnu.org; Tue, 23 Feb 2016 05:55:02 -0500 From: Gerd Hoffmann Date: Tue, 23 Feb 2016 11:54:53 +0100 Message-Id: <1456224898-23270-2-git-send-email-kraxel@redhat.com> In-Reply-To: <1456224898-23270-1-git-send-email-kraxel@redhat.com> References: <1456224898-23270-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PULL 1/6] usb: check USB configuration descriptor object List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Prasad J Pandit , Gerd Hoffmann From: Prasad J Pandit When processing remote NDIS control message packets, the USB Net device emulator checks to see if the USB configuration descriptor object is of RNDIS type(2). But it does not check if it is null, which leads to a null dereference error. Add check to avoid it. Reported-by: Qinghao Tang Signed-off-by: Prasad J Pandit Message-id: 1455188480-14688-1-git-send-email-ppandit@redhat.com Signed-off-by: Gerd Hoffmann --- hw/usb/dev-network.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c index 985a629..5dc4538 100644 --- a/hw/usb/dev-network.c +++ b/hw/usb/dev-network.c @@ -654,7 +654,8 @@ typedef struct USBNetState { static int is_rndis(USBNetState *s) { - return s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE; + return s->dev.config ? + s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE : 0; } static int ndis_query(USBNetState *s, uint32_t oid, -- 1.8.3.1