From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39512) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bSyHr-0005zc-TB for qemu-devel@nongnu.org; Thu, 28 Jul 2016 23:16:36 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bSyHo-00030X-Em for qemu-devel@nongnu.org; Thu, 28 Jul 2016 23:16:35 -0400 Received: from mx1.redhat.com ([209.132.183.28]:40662) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bSyHo-00030T-9B for qemu-devel@nongnu.org; Thu, 28 Jul 2016 23:16:32 -0400 Date: Fri, 29 Jul 2016 06:16:28 +0300 From: "Michael S. Tsirkin" Message-ID: <1469762011-7902-25-git-send-email-mst@redhat.com> References: <1469762011-7902-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline In-Reply-To: <1469762011-7902-1-git-send-email-mst@redhat.com> Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PULL 24/41] qemu-char: fix qemu_chr_fe_set_msgfds() crash when disconnected List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , =?iso-8859-1?Q?Marc-Andr=E9?= Lureau , Paolo Bonzini From: Marc-Andr=E9 Lureau Calling qemu_chr_fe_set_msgfds() on unconnected socket leads to crash since s->ioc is NULL in this case. Return an error earlier instead. Signed-off-by: Marc-Andr=E9 Lureau Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- qemu-char.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/qemu-char.c b/qemu-char.c index e4b8448..1274f50 100644 --- a/qemu-char.c +++ b/qemu-char.c @@ -2760,14 +2760,16 @@ static int tcp_set_msgfds(CharDriverState *chr, i= nt *fds, int num) { TCPCharDriver *s =3D chr->opaque; =20 - if (!qio_channel_has_feature(s->ioc, - QIO_CHANNEL_FEATURE_FD_PASS)) { - return -1; - } /* clear old pending fd array */ g_free(s->write_msgfds); s->write_msgfds =3D NULL; =20 + if (!s->connected || + !qio_channel_has_feature(s->ioc, + QIO_CHANNEL_FEATURE_FD_PASS)) { + return -1; + } + if (num) { s->write_msgfds =3D g_new(int, num); memcpy(s->write_msgfds, fds, num * sizeof(int)); --=20 MST