On 15/05/2025 06:44, Volker Rümelin wrote:
> AUD_open_out() may fail and return NULL. This may then lead to
> a segmentation fault in memset() below. The memset() behaviour
> is undefined if the pointer to the destination object is a null
> pointer.
>
> Add the missing error handling code.
>
> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
> ---
> hw/audio/asc.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/hw/audio/asc.c b/hw/audio/asc.c
> index 18382ccf6a..6721c0d9fb 100644
> --- a/hw/audio/asc.c
> +++ b/hw/audio/asc.c
> @@ -12,6 +12,7 @@
>
> #include "qemu/osdep.h"
> #include "qemu/timer.h"
> +#include "qapi/error.h"
> #include "hw/sysbus.h"
> #include "hw/irq.h"
> #include "audio/audio.h"
> @@ -653,6 +654,12 @@ static void asc_realize(DeviceState *dev, Error **errp)
>
> s->voice = AUD_open_out(&s->card, s->voice, "asc.out", s, asc_out_cb,
> &as);
> + if (!s->voice) {
> + AUD_remove_card(&s->card);
> + error_setg(errp, "Initializing audio stream failed");
> + return;
> + }
> +
> s->shift = 1;
> s->samples = AUD_get_buffer_size_out(s->voice) >> s->shift;
> s->mixbuf = g_malloc0(s->samples << s->shift);
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
ATB,
Mark.