summary refs log tree commit diff stats
diff options
context:
space:
mode:
authorAndreas Färber <afaerber@suse.de>2013-06-27 13:44:40 +0200
committerAndreas Färber <afaerber@suse.de>2013-07-23 02:38:32 +0200
commit52f34623b499cb0273118b1f637c2c6ebaf5d5a1 (patch)
treed8062f318976c4f02dce7891c4ad048100b17c23
parent3464700f6aecb3e2aa9098839d90672d6b3fa974 (diff)
downloadfocaccia-qemu-52f34623b499cb0273118b1f637c2c6ebaf5d5a1.tar.gz
focaccia-qemu-52f34623b499cb0273118b1f637c2c6ebaf5d5a1.zip
gdbstub: Change GDBState::query_cpu to CPUState
Since first_cpu/next_cpu are CPUState, CPUArchState is no longer needed.

This resolves a NULL pointer dereference of query_cpu, introduced
with commit 182735efaf956ccab50b6d74a4fed163e0f35660 and reported by
TeLeMan and Max Filippov.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Andreas Färber <afaerber@suse.de>
-rw-r--r--gdbstub.c9
1 files changed, 4 insertions, 5 deletions
diff --git a/gdbstub.c b/gdbstub.c
index 0ee82a944f..bdba19b404 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -289,7 +289,7 @@ enum RSState {
 typedef struct GDBState {
     CPUArchState *c_cpu; /* current CPU for step/continue ops */
     CPUArchState *g_cpu; /* current CPU for other ops */
-    CPUArchState *query_cpu; /* for q{f|s}ThreadInfo */
+    CPUState *query_cpu; /* for q{f|s}ThreadInfo */
     enum RSState state; /* parsing state */
     char line_buf[MAX_PACKET_LENGTH];
     int line_buf_index;
@@ -2401,15 +2401,14 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             put_packet(s, "QC1");
             break;
         } else if (strcmp(p,"fThreadInfo") == 0) {
-            s->query_cpu = first_cpu->env_ptr;
+            s->query_cpu = first_cpu;
             goto report_cpuinfo;
         } else if (strcmp(p,"sThreadInfo") == 0) {
         report_cpuinfo:
             if (s->query_cpu) {
-                snprintf(buf, sizeof(buf), "m%x",
-                         cpu_index(ENV_GET_CPU(s->query_cpu)));
+                snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu));
                 put_packet(s, buf);
-                s->query_cpu = ENV_GET_CPU(s->query_cpu)->next_cpu->env_ptr;
+                s->query_cpu = s->query_cpu->next_cpu;
             } else
                 put_packet(s, "l");
             break;