Received: from eggs.gnu.org ([2001:4830:134:3::10]:39487) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bokAc-0000es-Gz for qemu-devel@nongnu.org; Tue, 27 Sep 2016 00:39:07 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bokAW-0005Au-Hd for qemu-devel@nongnu.org; Tue, 27 Sep 2016 00:39:05 -0400 Received: from mail-oi0-x243.google.com ([2607:f8b0:4003:c06::243]:34134) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bokAW-0005Ag-9t for qemu-devel@nongnu.org; Tue, 27 Sep 2016 00:39:00 -0400 Received: by mail-oi0-x243.google.com with SMTP id a62so165004oib.1 for ; Mon, 26 Sep 2016 21:39:00 -0700 (PDT) Message-ID: <57e9f7e2.453fca0a.ec394.0b36@mx.google.com> From: Li Qiang Date: Mon, 26 Sep 2016 21:38:48 -0700 Subject: [Qemu-devel] [PATCH] 9pfs: fix NULL pointer dereference in v9fs_version List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: aneesh.kumar@linux.vnet.ibm.com, groug@kaod.org, qemu-devel@nongnu.org Cc: Li Qiang From: Li Qiang In 9pfs get version dispatch function, a guest can provide a NULL version string thus causing an NULL pointer dereference issue. This patch fix this issue. Signed-off-by: Li Qiang --- hw/9pfs/9p.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 119ee58..dd3145c 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -955,6 +955,11 @@ static void v9fs_version(void *opaque) offset = err; goto out; } + + if (!version.data) { + offset = -EINVAL; + goto out; + } trace_v9fs_version(pdu->tag, pdu->id, s->msize, version.data); virtfs_reset(pdu); -- 1.8.3.1