blob: b3ebfdc374d93d3ed4c2a79856d03aa6d0c8c859 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
files: 0.894
architecture: 0.824
performance: 0.820
graphic: 0.794
semantic: 0.757
register: 0.749
assembly: 0.709
device: 0.665
user-level: 0.649
vnc: 0.645
hypervisor: 0.643
debug: 0.637
network: 0.592
kernel: 0.547
ppc: 0.538
peripherals: 0.529
x86: 0.511
permissions: 0.493
mistranslation: 0.473
socket: 0.465
KVM: 0.463
boot: 0.459
PID: 0.458
arm: 0.454
VMM: 0.451
i386: 0.440
risc-v: 0.416
TCG: 0.401
virtual: 0.343
I'm not sure. But I Think I could cause the err(include/qemu/queue.h).
Description of problem:
At file "include/qemu/queue.h", Maybe I Think QTAILQ_REMOVE could cause a Error.
```
#define QTAILQ_REMOVE(head, elm, field) do { \
if (((elm)->field.tqe_next) != NULL) \
(elm)->field.tqe_next->field.tqe_circ.tql_prev = \
(elm)->field.tqe_circ.tql_prev; \
else \
(head)->tqh_circ.tql_prev = (elm)->field.tqe_circ.tql_prev; \
(elm)->field.tqe_circ.tql_prev->tql_next = (elm)->field.tqe_next; \
(elm)->field.tqe_circ.tql_prev = NULL; \
(elm)->field.tqe_circ.tql_next = NULL; \
(elm)->field.tqe_next = NULL; \
} while (/*CONSTCOND*/0)
```
If the length of the que is one, line 7 cause a segmentation fault.
Steps to reproduce:
1. Create a Que with QTAILQ_INIT
2. Add one element to que.
3. Remove the element with QTAILQ_REMOVE
Additional information:
queue.h file is located at "inclue/qemu/queue.h"
|