* [Qemu-devel] [PATCH 2/2] fw_cfg: fix crash if FW_CFG_WRITE_CHANNEL is used incorrectly
@ 2011-08-26 18:46 Blue Swirl
0 siblings, 0 replies; only message in thread
From: Blue Swirl @ 2011-08-26 18:46 UTC (permalink / raw)
To: qemu-devel
Avoid a crash if the guest combines FW_CFG_WRITE_CHANNEL with
a wrong value.
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
---
hw/fw_cfg.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/hw/fw_cfg.c b/hw/fw_cfg.c
index 663ad80..8df265c 100644
--- a/hw/fw_cfg.c
+++ b/hw/fw_cfg.c
@@ -214,7 +214,8 @@ static void fw_cfg_write(FWCfgState *s, uint8_t value)
FW_CFG_DPRINTF("write %d\n", value);
- if (s->cur_entry & FW_CFG_WRITE_CHANNEL && s->cur_offset < e->len) {
+ if (s->cur_entry & FW_CFG_WRITE_CHANNEL && e->callback &&
+ s->cur_offset < e->len) {
e->data[s->cur_offset++] = value;
if (s->cur_offset == e->len) {
e->callback(e->callback_opaque, e->data);
--
1.6.2.4
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2011-08-26 18:46 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-08-26 18:46 [Qemu-devel] [PATCH 2/2] fw_cfg: fix crash if FW_CFG_WRITE_CHANNEL is used incorrectly Blue Swirl
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.