On Mon, Oct 05, 2026 at 02:33:00 +0300, Elizaveta Tereshkina wrote:
> qemuMonitorGetCPUModelExpansion() may return 0 without assigning a value
> to model_info if QEMU returns a GenericError. Passing NULL to
> qemuConnectStealCPUModelFromInfo() can lead to the NULL
> pointer dereference. Check the result before stealing the CPU
> model to avoid this.
Can you, please, describe how exactly can
qemuMonitorGetCPUModelExpansion return zero without assigning to
model_info?
Looking at the code the only way the function could return zero is when
qemuMonitorJSONParseCPUModel returns zero. And that only happens in one
place:
*model_info = g_steal_pointer(&machine_model);
return 0;
machine_model is initialized with g_new0(qemuMonitorCPUModelInfo, 1)
just at the beginning of qemuMonitorJSONParseCPUModel.
Jirka
