2e70085 console: Avoid segfault in screendump

1 file Authored by mprivozn 5 years ago, Committed by Michael Roth 5 years ago,
1 file changed. 5 lines added. 0 lines removed.
    console: Avoid segfault in screendump
    
    After f771c5440e04626f1 it is possible to select device and
    head which to take screendump from. And even though we check if
    provided head number falls within range, it may still happen that
    the console has no surface yet leading to SIGSEGV:
    
      qemu.git $ ./x86_64-softmmu/qemu-system-x86_64 \
        -qmp stdio \
        -device virtio-vga,id=video0,max_outputs=4
    
      {"execute":"qmp_capabilities"}
      {"execute":"screendump", "arguments":{"filename":"/tmp/screen.ppm", "device":"video0", "head":1}}
      Segmentation fault
    
     #0  0x00005628249dda88 in ppm_save (filename=0x56282826cbc0 "/tmp/screen.ppm", ds=0x0, errp=0x7fff52a6fae0) at ui/console.c:304
     #1  0x00005628249ddd9b in qmp_screendump (filename=0x56282826cbc0 "/tmp/screen.ppm", has_device=true, device=0x5628276902d0 "video0", has_head=true, head=1, errp=0x7fff52a6fae0) at ui/console.c:375
     #2  0x00005628247740df in qmp_marshal_screendump (args=0x562828265e00, ret=0x7fff52a6fb68, errp=0x7fff52a6fb60) at qapi/qapi-commands-ui.c:110
    
    Here, @ds from frame #0 (or @surface from frame #1) is
    dereferenced at the very beginning of ppm_save(). And because
    it's NULL crash happens.
    
    Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
    Reviewed-by: Thomas Huth <thuth@redhat.com>
    Message-id: cb05bb1909daa6ba62145c0194aafa05a14ed3d1.1526569138.git.mprivozn@redhat.com
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    (cherry picked from commit 08d9864fa4e0c616e076ca8b225d39a7ecb189af)
    Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
    
        
file modified
+5 -0