memory_region_find returns the memory region with an elevated reference count. Drop the reference count also if the memory region cannot be mapped writable.
Signed-off-by: Paolo Bonzini <[email protected]> --- hw/i386/vapic.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/i386/vapic.c b/hw/i386/vapic.c index 8dd9188d96f..78dc2312bca 100644 --- a/hw/i386/vapic.c +++ b/hw/i386/vapic.c @@ -602,11 +602,13 @@ static int vapic_map_rom_writable(VAPICROMState *s) /* read ROM size from RAM region */ if (rom_paddr + 2 >= memory_region_size(section.mr)) { + memory_region_unref(section.mr); return -1; } ram = memory_region_get_ram_ptr(section.mr); rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE; if (rom_size == 0) { + memory_region_unref(section.mr); return -1; } s->rom_size = rom_size; -- 2.55.0
