Commit 3be7eb2f authored by Prasad J Pandit's avatar Prasad J Pandit Committed by Michael Roth
Browse files

qxl: check release info object 



When releasing spice resources in release_resource() routine,
if release info object 'ext.info' is null, it leads to null
pointer dereference. Add check to avoid it.

Reported-by: default avatarBugs SysSec <bugs-syssec@rub.de>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Message-id: 20190425063534.32747-1-ppandit@redhat.com
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit d52680fc)
Signed-off-by: default avatarMichael Roth <mdroth@linux.vnet.ibm.com>
parent 576964bf

hw/display/qxl.c

+3 −0
Original line number Diff line number Diff line
@@ -776,6 +776,9 @@ static void interface_release_resource(QXLInstance *sin, 
    QXLReleaseRing *ring;

    uint64_t *item, id;



    if (!ext.info) {

        return;

    }

    if (ext.group_id == MEMSLOT_GROUP_HOST) {

        /* host group -> vga mode update request */

        QXLCommandExt *cmdext = (void *)(intptr_t)(ext.info->id);