fw_cfg: fix crash if FW_CFG_WRITE_CHANNEL is used incorrectly

Avoid a crash if the guest combines FW_CFG_WRITE_CHANNEL with
a wrong value.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

diff --git a/hw/fw_cfg.c b/hw/fw_cfg.c
index 663ad80116e079afe6565db613848220f5666063..8df265c61d2c224504b0c7f15e4bcad7376ef6a8 100644 (file)
--- a/hw/fw_cfg.c
+++ b/hw/fw_cfg.c
@@ -214,7 +214,8 @@ static void fw_cfg_write(FWCfgState *s, uint8_t value)
 
     FW_CFG_DPRINTF("write %d\n", value);
 
-    if (s->cur_entry & FW_CFG_WRITE_CHANNEL && s->cur_offset < e->len) {
+    if (s->cur_entry & FW_CFG_WRITE_CHANNEL && e->callback &&
+        s->cur_offset < e->len) {
         e->data[s->cur_offset++] = value;
         if (s->cur_offset == e->len) {
             e->callback(e->callback_opaque, e->data);