Fix null pointer dereference when parsing chardevs without a backend option.

qemu_opt_get may return NULL, so handle that rather than crashing.

---
qemu-char.c | 9 ++++++++-

1 files changed, 8 insertions(+), 1 deletions(-)

index 9b69d92..f292ee7 100644
@@ -2434,6 +2434,7 @@ CharDriverState *qemu_chr_open_opts(QemuOpts *opts,
                                    void (*init)(struct CharDriverState *s))

{
    CharDriverState *chr;
+    const char *backend;
    int i;

    if (qemu_opts_id(opts) == NULL) {
@@ -2441,8 +2442,14 @@ CharDriverState *qemu_chr_open_opts(QemuOpts *opts,
        return NULL;
    }

+ backend = qemu_opt_get(opts, "backend");
+ if (!backend) {
+ fprintf(stderr, "chardev: backend option not specified\n");
+ return NULL;
+ }
+

    for (i = 0; i < ARRAY_SIZE(backend_table); i++) {
-        if (strcmp(backend_table[i].name, qemu_opt_get(opts, "backend")) == 0)
+        if (strcmp(backend_table[i].name, backend) == 0)
            break;
    }
    if (i == ARRAY_SIZE(backend_table)) {

1.5.4.3