qemu: prevent invalid reads in qemuAssignDevicePCISlots

Don't reserve slot 2 for video if the machine has no PCI buses.
Error out when the user specifies a video device without
a PCI address when there are no PCI buses.

(This wouldn't work on a machine with no PCI bus anyway since
we do add PCI addresses for video devices to the command line)

diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index aa69dca36fbef32122c1a790b215217b337a7b7d..d23bdfcec9758f83a000e5601406ae9e3898298f 100644 (file)
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -1909,6 +1909,9 @@ qemuAssignDevicePCISlots(virDomainDefPtr def,
             primaryVideo->info.addr.pci.function = 0;
             addrptr = &primaryVideo->info.addr.pci;
 
+            if (!qemuPCIAddressValidate(addrs, addrptr))
+                goto error;
+
             if (qemuDomainPCIAddressSlotInUse(addrs, addrptr)) {
                 if (qemuDeviceVideoUsable) {
                     virResetLastError();
@@ -1935,7 +1938,7 @@ qemuAssignDevicePCISlots(virDomainDefPtr def,
             /* If TYPE==PCI, then qemuCollectPCIAddress() function
              * has already reserved the address, so we must skip */
         }
-    } else if (!qemuDeviceVideoUsable) {
+    } else if (addrs->nbuses && !qemuDeviceVideoUsable) {
         memset(&tmp_addr, 0, sizeof(tmp_addr));
         tmp_addr.slot = 2;