On Mon, Oct 05, 2026 at 02:33:00 +0300, Elizaveta Tereshkina wrote:
qemuMonitorGetCPUModelExpansion() may return 0 without assigning a value to model_info if QEMU returns a GenericError. Passing NULL to qemuConnectStealCPUModelFromInfo() can lead to the NULL pointer dereference. Check the result before stealing the CPU model to avoid this.
Can you, please, describe how exactly can qemuMonitorGetCPUModelExpansion return zero without assigning to model_info? Looking at the code the only way the function could return zero is when qemuMonitorJSONParseCPUModel returns zero. And that only happens in one place: *model_info = g_steal_pointer(&machine_model); return 0; machine_model is initialized with g_new0(qemuMonitorCPUModelInfo, 1) just at the beginning of qemuMonitorJSONParseCPUModel. Jirka