qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: "Volker Rümelin" <vr_qemu@t-online.de>
To: "Gerd Hoffmann" <kraxel@redhat.com>,
	"Marc-André Lureau" <marcandre.lureau@redhat.com>,
	"Laurent Vivier" <laurent@vivier.eu>,
	"Paolo Bonzini" <pbonzini@redhat.com>,
	"Alex Bennée" <alex.bennee@linaro.org>
Cc: qemu-devel@nongnu.org,
	Richard Henderson <richard.henderson@linaro.org>,
	Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>,
	Thomas Huth <thuth@redhat.com>
Subject: [PATCH 4/7] hw/audio/asc: fix SIGSEGV in asc_realize()
Date: Sun, 11 May 2025 09:38:43 +0200	[thread overview]
Message-ID: <20250511073846.8713-4-vr_qemu@t-online.de> (raw)
In-Reply-To: <d456c188-0463-4dc2-9178-469f840eaebe@t-online.de>

AUD_open_out() may fail and return NULL. This may then lead to
a segmentation fault in memset() below. The memset() behaviour
is undefined if the pointer to the destination object is a null
pointer.

Add the missing error handling code.

Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
---
 hw/audio/asc.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/audio/asc.c b/hw/audio/asc.c
index 18382ccf6a..03dee0fcc7 100644
--- a/hw/audio/asc.c
+++ b/hw/audio/asc.c
@@ -12,6 +12,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/timer.h"
+#include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/irq.h"
 #include "audio/audio.h"
@@ -653,6 +654,12 @@ static void asc_realize(DeviceState *dev, Error **errp)
 
     s->voice = AUD_open_out(&s->card, s->voice, "asc.out", s, asc_out_cb,
                             &as);
+    if (!s->voice) {
+        asc_unrealize(dev);
+        error_setg(errp, "Initializing audio stream failed");
+        return;
+    }
+
     s->shift = 1;
     s->samples = AUD_get_buffer_size_out(s->voice) >> s->shift;
     s->mixbuf = g_malloc0(s->samples << s->shift);
-- 
2.43.0



  parent reply	other threads:[~2025-05-11  7:40 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-05-11  7:36 [PATCH 0/7] audio related fixes for 10.1 Volker Rümelin
2025-05-11  7:38 ` [PATCH 1/7] tests/functional: use 'none' audio driver for q800 tests Volker Rümelin
2025-05-11  7:38 ` [PATCH 2/7] audio: fix SIGSEGV in AUD_get_buffer_size_out() Volker Rümelin
2025-05-11  7:38 ` [PATCH 3/7] audio: fix size calculation " Volker Rümelin
2025-05-11  7:38 ` Volker Rümelin [this message]
2025-05-11 11:52   ` [PATCH 4/7] hw/audio/asc: fix SIGSEGV in asc_realize() Mark Cave-Ayland
2025-05-13  6:14     ` Volker Rümelin
2025-05-13  8:17       ` Mark Cave-Ayland
2025-05-14  5:43         ` Volker Rümelin
2025-05-11  7:38 ` [PATCH 5/7] hw/audio/asc: replace g_malloc0() with g_malloc() Volker Rümelin
2025-05-11 11:53   ` Mark Cave-Ayland
2025-05-11  7:38 ` [PATCH 6/7] audio/mixeng: remove unnecessary pointer type casts Volker Rümelin
2025-05-11  7:38 ` [PATCH 7/7] audio: add float sample endianness converters Volker Rümelin
2025-05-11 10:08 ` [PATCH 0/7] audio related fixes for 10.1 Marc-André Lureau
2025-05-13  6:40 ` Michael Tokarev
2025-05-14  6:26   ` Volker Rümelin
2025-05-14  9:19     ` Michael Tokarev

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250511073846.8713-4-vr_qemu@t-online.de \
    --to=vr_qemu@t-online.de \
    --cc=alex.bennee@linaro.org \
    --cc=kraxel@redhat.com \
    --cc=laurent@vivier.eu \
    --cc=marcandre.lureau@redhat.com \
    --cc=mark.cave-ayland@ilande.co.uk \
    --cc=pbonzini@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=richard.henderson@linaro.org \
    --cc=thuth@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).