--
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming blog: http://rwmj.wordpress.com
Fedora now supports 80 OCaml packages (the OPEN alternative to F#)
http://cocan.org/getting_started_with_ocaml_on_red_hat_and_fedora
>From aded1d171a2b8f12830a43b3a0893da9acb708ff Mon Sep 17 00:00:00 2001
From: Richard Jones <rjo...@redhat.com>
Date: Sat, 17 Jul 2010 14:23:21 +0100
Subject: [PATCH 1/2] Don't call fw_cfg e->callback if e->callback is NULL.
If you set up a fw_cfg writable entry without a callback, then
e->callback is still called, causing qemu to segfault.
Luckily since nothing in qemu uses writable entries at the moment,
this is not exploitable.
Signed-off-by: Richard W.M. Jones <rjo...@redhat.com>
---
hw/fw_cfg.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/hw/fw_cfg.c b/hw/fw_cfg.c
index 72866ae..37e6f1f 100644
--- a/hw/fw_cfg.c
+++ b/hw/fw_cfg.c
@@ -65,7 +65,8 @@ static void fw_cfg_write(FWCfgState *s, uint8_t value)
if (s->cur_entry & FW_CFG_WRITE_CHANNEL && s->cur_offset < e->len) {
e->data[s->cur_offset++] = value;
if (s->cur_offset == e->len) {
- e->callback(e->callback_opaque, e->data);
+ if (e->callback)
+ e->callback(e->callback_opaque, e->data);
s->cur_offset = 0;
}
}
--
1.7.1
