From nobody Wed Oct 29 23:02:04 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (208.118.235.17 [208.118.235.17]) by mx.zohomail.com with SMTPS id 1526569331771459.3114415025748; Thu, 17 May 2018 08:02:11 -0700 (PDT) Received: from localhost ([::1]:59773 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fJKPs-0004DU-Qe for importer@patchew.org; Thu, 17 May 2018 11:02:04 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40213) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fJKOn-0003o8-FX for qemu-devel@nongnu.org; Thu, 17 May 2018 11:01:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fJKOh-0005iR-UM for qemu-devel@nongnu.org; Thu, 17 May 2018 11:00:57 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:35518 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fJKOh-0005hy-Ps for qemu-devel@nongnu.org; Thu, 17 May 2018 11:00:51 -0400 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id B43644201B08 for ; Thu, 17 May 2018 15:00:50 +0000 (UTC) Received: from moe.brq.redhat.com (unknown [10.43.2.192]) by smtp.corp.redhat.com (Postfix) with ESMTP id 1658C2166BAD; Thu, 17 May 2018 15:00:49 +0000 (UTC) From: Michal Privoznik To: qemu-devel@nongnu.org Date: Thu, 17 May 2018 17:00:11 +0200 Message-Id: X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.7]); Thu, 17 May 2018 15:00:50 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.7]); Thu, 17 May 2018 15:00:50 +0000 (UTC) for IP:'10.11.54.6' DOMAIN:'int-mx06.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'mprivozn@redhat.com' RCPT:'' X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PATCH] console: Avoid segfault in screendump X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: thuth@redhat.com, kraxel@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" After f771c5440e04626f1 it is possible to select device and head which to take screendump from. And even though we check if provided head number falls within range, it may still happen that the console has no surface yet leading to SIGSEGV: qemu.git $ ./x86_64-softmmu/qemu-system-x86_64 \ -qmp stdio \ -device virtio-vga,id=3Dvideo0,max_outputs=3D4 {"execute":"qmp_capabilities"} {"execute":"screendump", "arguments":{"filename":"/tmp/screen.ppm", "devi= ce":"video0", "head":1}} Segmentation fault #0 0x00005628249dda88 in ppm_save (filename=3D0x56282826cbc0 "/tmp/screen= .ppm", ds=3D0x0, errp=3D0x7fff52a6fae0) at ui/console.c:304 #1 0x00005628249ddd9b in qmp_screendump (filename=3D0x56282826cbc0 "/tmp/= screen.ppm", has_device=3Dtrue, device=3D0x5628276902d0 "video0", has_head= =3Dtrue, head=3D1, errp=3D0x7fff52a6fae0) at ui/console.c:375 #2 0x00005628247740df in qmp_marshal_screendump (args=3D0x562828265e00, r= et=3D0x7fff52a6fb68, errp=3D0x7fff52a6fb60) at qapi/qapi-commands-ui.c:110 Here, @ds from frame #0 (or @surface from frame #1) is dereferenced at the very beginning of ppm_save(). And because it's NULL crash happens. Signed-off-by: Michal Privoznik Reviewed-by: Thomas Huth --- I'm not entirely sure if this is the right approach, but crasher is bad for sure. ui/console.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ui/console.c b/ui/console.c index 945f05d728..ef1247f872 100644 --- a/ui/console.c +++ b/ui/console.c @@ -372,6 +372,11 @@ void qmp_screendump(const char *filename, bool has_dev= ice, const char *device, =20 graphic_hw_update(con); surface =3D qemu_console_surface(con); + if (!surface) { + error_setg(errp, "no surface"); + return; + } + ppm_save(filename, surface, errp); } =20 --=20 2.16.1