mirror of
https://github.com/xemu-project/xemu.git
synced 2026-07-11 01:24:41 +02:00
Peter Maydell
579be921f5
In fimd_update_memory_section() we attempt ot find and map part of the RAM MR which backs the framebuffer, based on guest-configurable size and start address. If the guest configures framebuffer settings which result in a zero-sized framebuffer, we hit an assertion(), because memory_region_find() will return a NULL mem_section.mr. Explicitly check for the zero-size case and treat this as a guest error. Because we now have a code path which can reach error_return without calling memory_region_find to set w->mem_section, we must NULL out w->mem_section.mr after the unref of the old MR, so that error_return does not incorrectly double-unref the old MR. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1407 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20251107143913.1341358-1-peter.maydell@linaro.org