[Qemu-devel] [PATCH REPOST] Don't call fw_cfg e->callback if e->callback is NULL.

[Qemu-devel] [PATCH REPOST] Don't call fw_cfg e->callback if e->callback is NULL.

[Richard W.M. Jones]

[-- Attachment #1: Type: text/plain, Size: 454 bytes --]


This is just a plain and obvious bug in fw_cfg.  It's not currently
hit because there are no writable entries in fw_cfg at the moment, but
as soon as you add one, you hit this segfault.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into Xen guests.
http://et.redhat.com/~rjones/virt-p2v

[-- Attachment #2: 0001-Don-t-call-fw_cfg-e-callback-if-e-callback-is-NULL.patch --]
[-- Type: text/plain, Size: 1107 bytes --]

>From 69f2a3848a825c6dc94ec7d415889e19ae48e3c7 Mon Sep 17 00:00:00 2001
From: Richard Jones <rjones@redhat.com>
Date: Sat, 17 Jul 2010 14:23:21 +0100
Subject: [PATCH] Don't call fw_cfg e->callback if e->callback is NULL.

If you set up a fw_cfg writable entry without a callback, then
e->callback is still called, causing qemu to segfault.

Luckily since nothing in qemu uses writable entries at the moment,
this is not exploitable.

Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
---
 hw/fw_cfg.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/hw/fw_cfg.c b/hw/fw_cfg.c
index 72866ae..37e6f1f 100644
--- a/hw/fw_cfg.c
+++ b/hw/fw_cfg.c
@@ -65,7 +65,8 @@ static void fw_cfg_write(FWCfgState *s, uint8_t value)
     if (s->cur_entry & FW_CFG_WRITE_CHANNEL && s->cur_offset < e->len) {
         e->data[s->cur_offset++] = value;
         if (s->cur_offset == e->len) {
-            e->callback(e->callback_opaque, e->data);
+            if (e->callback)
+                e->callback(e->callback_opaque, e->data);
             s->cur_offset = 0;
         }
     }
-- 
1.7.1