motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-09 10:34:58 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

hw/audio/asc: fix SIGSEGV in asc_realize()

Browse source 
AUD_open_out() may fail and return NULL. This may then lead to
a segmentation fault in memset() below. The memset() behaviour
is undefined if the pointer to the destination object is a null
pointer.

Add the missing error handling code.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-Id: <20250515054429.7385-4-vr_qemu@t-online.de>
This commit is contained in:
Volker Rümelin 2025-05-15 07:44:26 +02:00 • committed by Marc-André Lureau
parent ccb4fec0e5
commit d009f26a54
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
hw/audio/asc.c
View file

@ -12,6 +12,7 @@
#include "qemu/osdep.h"
#include "qemu/timer.h"
#include "qapi/error.h"
#include "hw/sysbus.h"
#include "hw/irq.h"
#include "audio/audio.h"
@ -653,6 +654,12 @@ static void asc_realize(DeviceState *dev, Error **errp)
s->voice = AUD_open_out(&s->card, s->voice, "asc.out", s, asc_out_cb,
&as);
if (!s->voice) {
AUD_remove_card(&s->card);
error_setg(errp, "Initializing audio stream failed");
return;
}
s->shift = 1;
s->samples = AUD_get_buffer_size_out(s->voice) >> s->shift;
s->mixbuf = g_malloc0(s->samples << s->shift);