[Qemu-devel] Bug: Dereferencing -1 Crashes Qemu

[Kent Borg]

Running qemu-0.9.1 with kqemu 1.3.0~pre11.  Lunix host, Linux guest.  If
I dereference a -1 the entire guest crashes.

-kb, the Kent who isn't subscribed.



$ make hello
cc     hello.c   -o hello
hello.c: In function ‘main’:
hello.c:8: warning: assignment makes pointer from integer without a cast
$ cat hello.c
#include <stdio.h>
#include <stdlib.h>

main()
{
  int *ptr;

  ptr = -1;

  printf("hello, world\n");
  printf("%d\n", *ptr);
}
$ ./hello
hello, world
EAX=00000292 EBX=c552ee00 ECX=00000292 EDX=00000000
ESI=c548c000 EDI=00000000 EBP=c7b6cc0d ESP=c5445f14
EIP=c033005d EFL=00010286 [--S--P-] CPL=3 II=0 A20=1 SMM=0 HLT=0
ES =007b 00000000 ffffffff 00cff300
CS =0060 00000000 ffffffff 00cffb00
SS =0068 00000000 ffffffff 00cff300
DS =007b 00000000 ffffffff 00cff300
FS =0000 00000000 00000000 00000000
GS =0033 b7e136b0 ffffffff b7dff3e1
LDT=0000 00000000 00000000 00008000
TR =0080 c1107100 00002073 00008900
GDT=     c1104000 000000ff
IDT=     c0429000 000007ff
CR0=8005003b CR2=b7edb2d0 CR3=06dbb000 CR4=000006b0
Unsupported return value: 0xffffffff
address@hidden:~#