From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=52475 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Oa7ci-0007hF-DO for qemu-devel@nongnu.org; Sat, 17 Jul 2010 09:40:13 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.69) (envelope-from ) id 1Oa7cg-0004uX-VZ for qemu-devel@nongnu.org; Sat, 17 Jul 2010 09:40:12 -0400 Received: from mx1.redhat.com ([209.132.183.28]:23950) by eggs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1Oa7cg-0004uJ-ON for qemu-devel@nongnu.org; Sat, 17 Jul 2010 09:40:10 -0400 Received: from int-mx04.intmail.prod.int.phx2.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.17]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o6HDe9eh012506 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Sat, 17 Jul 2010 09:40:09 -0400 Received: from localhost (vpn1-5-71.ams2.redhat.com [10.36.5.71]) by int-mx04.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id o6HDe8dm031755 for ; Sat, 17 Jul 2010 09:40:09 -0400 Date: Sat, 17 Jul 2010 14:40:08 +0100 From: "Richard W.M. Jones" Message-ID: <20100717134008.GA20292@amd.home.annexia.org> References: <20100717133930.GC19767@amd.home.annexia.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="k+w/mQv8wyuph6w0" Content-Disposition: inline In-Reply-To: <20100717133930.GC19767@amd.home.annexia.org> Subject: [Qemu-devel] [PATCH 1/2] Don't call fw_cfg e->callback if e->callback is NULL. List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org --k+w/mQv8wyuph6w0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming blog: http://rwmj.wordpress.com Fedora now supports 80 OCaml packages (the OPEN alternative to F#) http://cocan.org/getting_started_with_ocaml_on_red_hat_and_fedora --k+w/mQv8wyuph6w0 Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="0001-Don-t-call-fw_cfg-e-callback-if-e-callback-is-NULL.patch" >>From aded1d171a2b8f12830a43b3a0893da9acb708ff Mon Sep 17 00:00:00 2001 From: Richard Jones Date: Sat, 17 Jul 2010 14:23:21 +0100 Subject: [PATCH 1/2] Don't call fw_cfg e->callback if e->callback is NULL. If you set up a fw_cfg writable entry without a callback, then e->callback is still called, causing qemu to segfault. Luckily since nothing in qemu uses writable entries at the moment, this is not exploitable. Signed-off-by: Richard W.M. Jones --- hw/fw_cfg.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/hw/fw_cfg.c b/hw/fw_cfg.c index 72866ae..37e6f1f 100644 --- a/hw/fw_cfg.c +++ b/hw/fw_cfg.c @@ -65,7 +65,8 @@ static void fw_cfg_write(FWCfgState *s, uint8_t value) if (s->cur_entry & FW_CFG_WRITE_CHANNEL && s->cur_offset < e->len) { e->data[s->cur_offset++] = value; if (s->cur_offset == e->len) { - e->callback(e->callback_opaque, e->data); + if (e->callback) + e->callback(e->callback_opaque, e->data); s->cur_offset = 0; } } -- 1.7.1 --k+w/mQv8wyuph6w0--