From 60df0d1b59e02c4ef2964473f84b707153ccad58 Mon Sep 17 00:00:00 2001

From: Gerd Hoffmann <kraxel@redhat.com>

Date: Tue, 13 Aug 2019 12:21:56 +0100

Subject: [PATCH 1/3] console: Avoid segfault in screendump

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

RH-Author: Gerd Hoffmann <kraxel@redhat.com>

Message-id: <20190813122156.5609-2-kraxel@redhat.com>

Patchwork-id: 89958

O-Subject: [RHEL-8.1.0 qemu-kvm PATCH 1/1] console: Avoid segfault in screendump

Bugzilla: 1684383

RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>

RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

RH-Acked-by: John Snow <jsnow@redhat.com>

From: Michal Privoznik <mprivozn@redhat.com>

After f771c5440e04626f1 it is possible to select device and

head which to take screendump from. And even though we check if

provided head number falls within range, it may still happen that

the console has no surface yet leading to SIGSEGV:

  qemu.git $ ./x86_64-softmmu/qemu-system-x86_64 \

    -qmp stdio \

    -device virtio-vga,id=video0,max_outputs=4

  {"execute":"qmp_capabilities"}

  {"execute":"screendump", "arguments":{"filename":"/tmp/screen.ppm", "device":"video0", "head":1}}

  Segmentation fault

 #0  0x00005628249dda88 in ppm_save (filename=0x56282826cbc0 "/tmp/screen.ppm", ds=0x0, errp=0x7fff52a6fae0) at ui/console.c:304

 #1  0x00005628249ddd9b in qmp_screendump (filename=0x56282826cbc0 "/tmp/screen.ppm", has_device=true, device=0x5628276902d0 "video0", has_head=true, head=1, errp=0x7fff52a6fae0) at ui/console.c:375

 #2  0x00005628247740df in qmp_marshal_screendump (args=0x562828265e00, ret=0x7fff52a6fb68, errp=0x7fff52a6fb60) at qapi/qapi-commands-ui.c:110

Here, @ds from frame #0 (or @surface from frame #1) is

dereferenced at the very beginning of ppm_save(). And because

it's NULL crash happens.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>

Reviewed-by: Thomas Huth <thuth@redhat.com>

Message-id: cb05bb1909daa6ba62145c0194aafa05a14ed3d1.1526569138.git.mprivozn@redhat.com

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

(cherry picked from commit 08d9864fa4e0c616e076ca8b225d39a7ecb189af)

Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>

---

 ui/console.c | 5 +++++

 1 file changed, 5 insertions(+)

diff --git a/ui/console.c b/ui/console.c

index 594ec63..4e4052f 100644

--- a/ui/console.c

+++ b/ui/console.c

@@ -370,6 +370,11 @@ void qmp_screendump(const char *filename, bool has_device, const char *device,

     graphic_hw_update(con);

     surface = qemu_console_surface(con);

+    if (!surface) {

+        error_setg(errp, "no surface");

+        return;

+    }

+

     ppm_save(filename, surface, errp);

 }

-- 

1.8.3.1