From 5c7eaabf65ba936f718ef4dfcfc551ffc9d4f35c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Wed, 27 Jul 2016 01:15:08 +0400 Subject: [PATCH] qemu-char: fix qemu_chr_fe_set_msgfds() crash when disconnected MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Calling qemu_chr_fe_set_msgfds() on unconnected socket leads to crash since s->ioc is NULL in this case. Return an error earlier instead. Signed-off-by: Marc-André Lureau Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- qemu-char.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/qemu-char.c b/qemu-char.c index e4b8448422..1274f50e00 100644 --- a/qemu-char.c +++ b/qemu-char.c @@ -2760,14 +2760,16 @@ static int tcp_set_msgfds(CharDriverState *chr, int *fds, int num) { TCPCharDriver *s = chr->opaque; - if (!qio_channel_has_feature(s->ioc, - QIO_CHANNEL_FEATURE_FD_PASS)) { - return -1; - } /* clear old pending fd array */ g_free(s->write_msgfds); s->write_msgfds = NULL; + if (!s->connected || + !qio_channel_has_feature(s->ioc, + QIO_CHANNEL_FEATURE_FD_PASS)) { + return -1; + } + if (num) { s->write_msgfds = g_new(int, num); memcpy(s->write_msgfds, fds, num * sizeof(int));