qemu_chardev_set_replay() was being called in chardev creation to
set up replay parameters even if the chardev is NULL.

A segfault can be reproduced by specifying '-serial chardev:bad' with
an rr=record mode.

Fix this with a NULL pointer check.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Resolves: Coverity CID 1559470
Fixes: 4c193bb129dae ("chardev: set record/replay on the base device of a muxed device")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
---
 chardev/char.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/chardev/char.c b/chardev/char.c
index ba847b6e9e..47a744ebeb 100644
--- a/chardev/char.c
+++ b/chardev/char.c
@@ -721,7 +721,7 @@ static Chardev *__qemu_chr_new(const char *label, const char *filename,
 
     if (strstart(filename, "chardev:", &p)) {
         chr = qemu_chr_find(p);
-        if (replay) {
+        if (replay && chr) {
             qemu_chardev_set_replay(chr, &err);
             if (err) {
                 error_report_err(err);
-- 
2.45.2

On Wed, 28 Aug 2024 at 05:33, Nicholas Piggin <npiggin@gmail.com> wrote:
>
> qemu_chardev_set_replay() was being called in chardev creation to
> set up replay parameters even if the chardev is NULL.
>
> A segfault can be reproduced by specifying '-serial chardev:bad' with
> an rr=record mode.
>
> Fix this with a NULL pointer check.
>
> Reported-by: Peter Maydell <peter.maydell@linaro.org>
> Resolves: Coverity CID 1559470
> Fixes: 4c193bb129dae ("chardev: set record/replay on the base device of a muxed device")
> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
> ---
>  chardev/char.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/chardev/char.c b/chardev/char.c
> index ba847b6e9e..47a744ebeb 100644
> --- a/chardev/char.c
> +++ b/chardev/char.c
> @@ -721,7 +721,7 @@ static Chardev *__qemu_chr_new(const char *label, const char *filename,
>
>      if (strstart(filename, "chardev:", &p)) {
>          chr = qemu_chr_find(p);
> -        if (replay) {
> +        if (replay && chr) {
>              qemu_chardev_set_replay(chr, &err);
>              if (err) {
>                  error_report_err(err);
> --

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM