From 962d4b2834e6a3b37784391a906b5fe2a7e96b74 Mon Sep 17 00:00:00 2001 From: Blue Swirl Date: Fri, 26 Aug 2011 18:43:18 +0000 Subject: [PATCH] fw_cfg: fix crash if FW_CFG_WRITE_CHANNEL is used incorrectly Avoid a crash if the guest combines FW_CFG_WRITE_CHANNEL with a wrong value. Signed-off-by: Blue Swirl --- hw/fw_cfg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/fw_cfg.c b/hw/fw_cfg.c index 663ad80116..8df265c61d 100644 --- a/hw/fw_cfg.c +++ b/hw/fw_cfg.c @@ -214,7 +214,8 @@ static void fw_cfg_write(FWCfgState *s, uint8_t value) FW_CFG_DPRINTF("write %d\n", value); - if (s->cur_entry & FW_CFG_WRITE_CHANNEL && s->cur_offset < e->len) { + if (s->cur_entry & FW_CFG_WRITE_CHANNEL && e->callback && + s->cur_offset < e->len) { e->data[s->cur_offset++] = value; if (s->cur_offset == e->len) { e->callback(e->callback_opaque, e->data);