From patchwork Tue Mar 22 16:32:50 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Michael S. Tsirkin" X-Patchwork-Id: 87945 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [199.232.76.165]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 8437FB6F11 for ; Wed, 23 Mar 2011 03:58:44 +1100 (EST) Received: from localhost ([127.0.0.1]:46933 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Q24Wr-0006l9-0c for incoming@patchwork.ozlabs.org; Tue, 22 Mar 2011 12:33:57 -0400 Received: from [140.186.70.92] (port=48171 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Q24W6-0006cR-Du for qemu-devel@nongnu.org; Tue, 22 Mar 2011 12:33:14 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Q24W1-0004QJ-4U for qemu-devel@nongnu.org; Tue, 22 Mar 2011 12:33:07 -0400 Received: from mx1.redhat.com ([209.132.183.28]:55570) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Q24W0-0004Py-MY for qemu-devel@nongnu.org; Tue, 22 Mar 2011 12:33:05 -0400 Received: from int-mx12.intmail.prod.int.phx2.redhat.com (int-mx12.intmail.prod.int.phx2.redhat.com [10.5.11.25]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p2MGX3iI000611 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Tue, 22 Mar 2011 12:33:03 -0400 Received: from redhat.com (dhcp-1-35.tlv.redhat.com [10.35.1.35]) by int-mx12.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with SMTP id p2MGX1F6004643; Tue, 22 Mar 2011 12:33:02 -0400 Date: Tue, 22 Mar 2011 18:32:50 +0200 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org, Amit Shah Message-ID: <20110322163250.GA6426@redhat.com> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) X-Scanned-By: MIMEDefang 2.68 on 10.5.11.25 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 209.132.183.28 Cc: Subject: [Qemu-devel] [PATCH] virtio-serial: don't crash on invalid input X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Fix crash on invalid input in virtio-serial. Discovered by code review, untested. Signed-off-by: Michael S. Tsirkin Acked-by: Amit Shah --- hw/virtio-serial-bus.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c index e0bf6c5..8807a2f 100644 --- a/hw/virtio-serial-bus.c +++ b/hw/virtio-serial-bus.c @@ -654,6 +654,9 @@ static int virtio_serial_load(QEMUFile *f, void *opaque, int version_id) id = qemu_get_be32(f); port = find_port_by_id(s, id); + if (!port) { + return -EINVAL; + } port->guest_connected = qemu_get_byte(f); host_connected = qemu_get_byte(f);