From: "Volker Rümelin" <vr_qemu@t-online.de>
To: "Gerd Hoffmann" <kraxel@redhat.com>,
"Marc-André Lureau" <marcandre.lureau@redhat.com>,
"Laurent Vivier" <laurent@vivier.eu>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"Alex Bennée" <alex.bennee@linaro.org>
Cc: qemu-devel@nongnu.org,
Richard Henderson <richard.henderson@linaro.org>,
Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>,
Thomas Huth <thuth@redhat.com>
Subject: [PATCH 4/7] hw/audio/asc: fix SIGSEGV in asc_realize()
Date: Sun, 11 May 2025 09:38:43 +0200 [thread overview]
Message-ID: <20250511073846.8713-4-vr_qemu@t-online.de> (raw)
In-Reply-To: <d456c188-0463-4dc2-9178-469f840eaebe@t-online.de>
AUD_open_out() may fail and return NULL. This may then lead to
a segmentation fault in memset() below. The memset() behaviour
is undefined if the pointer to the destination object is a null
pointer.
Add the missing error handling code.
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
---
hw/audio/asc.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/hw/audio/asc.c b/hw/audio/asc.c
index 18382ccf6a..03dee0fcc7 100644
--- a/hw/audio/asc.c
+++ b/hw/audio/asc.c
@@ -12,6 +12,7 @@
#include "qemu/osdep.h"
#include "qemu/timer.h"
+#include "qapi/error.h"
#include "hw/sysbus.h"
#include "hw/irq.h"
#include "audio/audio.h"
@@ -653,6 +654,12 @@ static void asc_realize(DeviceState *dev, Error **errp)
s->voice = AUD_open_out(&s->card, s->voice, "asc.out", s, asc_out_cb,
&as);
+ if (!s->voice) {
+ asc_unrealize(dev);
+ error_setg(errp, "Initializing audio stream failed");
+ return;
+ }
+
s->shift = 1;
s->samples = AUD_get_buffer_size_out(s->voice) >> s->shift;
s->mixbuf = g_malloc0(s->samples << s->shift);
--
2.43.0
next prev parent reply other threads:[~2025-05-11 7:40 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-05-11 7:36 [PATCH 0/7] audio related fixes for 10.1 Volker Rümelin
2025-05-11 7:38 ` [PATCH 1/7] tests/functional: use 'none' audio driver for q800 tests Volker Rümelin
2025-05-11 7:38 ` [PATCH 2/7] audio: fix SIGSEGV in AUD_get_buffer_size_out() Volker Rümelin
2025-05-11 7:38 ` [PATCH 3/7] audio: fix size calculation " Volker Rümelin
2025-05-11 7:38 ` Volker Rümelin [this message]
2025-05-11 11:52 ` [PATCH 4/7] hw/audio/asc: fix SIGSEGV in asc_realize() Mark Cave-Ayland
2025-05-13 6:14 ` Volker Rümelin
2025-05-13 8:17 ` Mark Cave-Ayland
2025-05-14 5:43 ` Volker Rümelin
2025-05-11 7:38 ` [PATCH 5/7] hw/audio/asc: replace g_malloc0() with g_malloc() Volker Rümelin
2025-05-11 11:53 ` Mark Cave-Ayland
2025-05-11 7:38 ` [PATCH 6/7] audio/mixeng: remove unnecessary pointer type casts Volker Rümelin
2025-05-11 7:38 ` [PATCH 7/7] audio: add float sample endianness converters Volker Rümelin
2025-05-11 10:08 ` [PATCH 0/7] audio related fixes for 10.1 Marc-André Lureau
2025-05-13 6:40 ` Michael Tokarev
2025-05-14 6:26 ` Volker Rümelin
2025-05-14 9:19 ` Michael Tokarev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250511073846.8713-4-vr_qemu@t-online.de \
--to=vr_qemu@t-online.de \
--cc=alex.bennee@linaro.org \
--cc=kraxel@redhat.com \
--cc=laurent@vivier.eu \
--cc=marcandre.lureau@redhat.com \
--cc=mark.cave-ayland@ilande.co.uk \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=richard.henderson@linaro.org \
--cc=thuth@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).