Re: [Qemu-devel] [PULL 03/15] audio: basic support for multi backend audio

[Peter Maydell]

On Wed, 21 Aug 2019 at 09:49, Gerd Hoffmann <address@hidden> wrote:
>
> From: Kővágó, Zoltán <address@hidden>
>
> Audio functions no longer access glob_audio_state, instead they get an
> AudioState as a parameter.  This is required in order to support
> multiple backends.
>
> glob_audio_state is also gone, and replaced with a tailq so we can store
> more than one states.
>
> Signed-off-by: Kővágó, Zoltán <address@hidden>
> Message-id: address@hidden
> Signed-off-by: Gerd Hoffmann <address@hidden>

Hi; Coverity spotted an issue in this patch:


> diff --git a/audio/audio_template.h b/audio/audio_template.h
> index c721fed75d7d..54f07338e76f 100644
> --- a/audio/audio_template.h
> +++ b/audio/audio_template.h
> @@ -428,7 +428,7 @@ SW *glue (AUD_open_, TYPE) (
>      struct audsettings *as
>      )
>  {
> -    AudioState *s = &glob_audio_state;
> +    AudioState *s = card->state;

Here we dereference 'card'...

>      AudiodevPerDirectionOptions *pdo = glue(audio_get_pdo_, TYPE)(s->dev);
>
>      if (audio_bug(__func__, !card || !name || !callback_fn || !as)) {

...but that is before this check on whether card is NULL.
The deref needs to go after the NULL-check.

This is issues CID 1405305 and 1405301 (one each for
AUD_open_in and AUD_open_out).

thanks
-- PMM