Merge tag 'v1.1.2' into stable-1.1qemu-kvm-1.1.2stable-1.1

* tag 'v1.1.2': (74 commits)
  update VERSION for 1.1.2
  console: bounds check whenever changing the cursor due to an escape code
  qemu-timer: properly arm alarm timer for timers set by device initialization
  target-xtensa: return ENOSYS for unimplemented simcalls
  target-xtensa: fix big-endian BBS/BBC implementation
  ehci: Fix NULL ptr deref when unplugging an USB dev with an iso stream active
  msix: make [un]use vectors on reset/load optional
  reset PMBA and PMREGMISC PIIX4 registers.
  qemu_rearm_alarm_timer: do not call rearm if the next deadline is INT64_MAX
  qemu-ga: Fix null pointer passed to unlink in failure branch
  memory: Fix copy&paste mistake in memory_region_iorange_write
  ivshmem: remove redundant ioeventfd configuration
  hw/arm_gic.c: Define .class_size in arm_gic_info TypeInfo
  tcg/mips: fix broken CONFIG_TCG_PASS_AREG0 code
  audio/winwave: previous audio buffer should be flushed
  target-mips: allow microMIPS SWP and SDP to have RD equal to BASE
  target-mips: add privilege level check to several Cop0 instructions
  mips-linux-user: Always support rdhwr.
  target-mips: Streamline indexed cp1 memory addressing.
  Fix order of CVT.PS.S operands
  ...

Signed-off-by: Avi Kivity <avi@redhat.com>

1 files changed, 4 insertions, 1 deletions

diff --git a/softmmu-semi.h b/softmmu-semi.h
index 648cb959d..bcb979a5b 100644
--- a/softmmu-semi.h
+++ b/softmmu-semi.h
@@ -40,7 +40,7 @@ static void *softmmu_lock_user(CPUArchState *env, uint32_t addr, uint32_t len,
     uint8_t *p;
     /* TODO: Make this something that isn't fixed size.  */
     p = malloc(len);
-    if (copy)
+    if (p && copy)
         cpu_memory_rw_debug(env, addr, p, len, 0);
     return p;
 }
@@ -52,6 +52,9 @@ static char *softmmu_lock_user_string(CPUArchState *env, uint32_t addr)
     uint8_t c;
     /* TODO: Make this something that isn't fixed size.  */
     s = p = malloc(1024);
+    if (!s) {
+        return NULL;
+    }
     do {
         cpu_memory_rw_debug(env, addr, &c, 1, 0);
         addr++;