From: Nicholas Piggin <npiggin@gmail.com>
Date: Wed, 28 Aug 2024 04:33:34 +0000 (+1000)
Subject: chardev: Fix record/replay error path NULL deref in device creation
X-Git-Tag: v9.2.0-rc3~1^2~1
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=651b386205d7578e8de60df0ec3830b315f6686f;p=thirdparty%2Fqemu.git

chardev: Fix record/replay error path NULL deref in device creation

qemu_chardev_set_replay() was being called in chardev creation to
set up replay parameters even if the chardev is NULL.

A segfault can be reproduced by specifying '-serial chardev:bad' with
an rr=record mode.

Fix this with a NULL pointer check.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Resolves: Coverity CID 1559470
Fixes: 4c193bb129dae ("chardev: set record/replay on the base device of a muxed device")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20240828043337.14587-2-npiggin@gmail.com>
---

diff --git a/chardev/char.c b/chardev/char.c
index a1722aa076d..1c7f6c711a9 100644
--- a/chardev/char.c
+++ b/chardev/char.c
@@ -726,7 +726,7 @@ static Chardev *__qemu_chr_new(const char *label, const char *filename,
 
     if (strstart(filename, "chardev:", &p)) {
         chr = qemu_chr_find(p);
-        if (replay) {
+        if (replay && chr) {
             qemu_chardev_set_replay(chr, &err);
             if (err) {
                 error_report_err(err);