--- xen-4.6.1/tools/qemu-xen-traditional/hw/fw_cfg.c.orig	2016-01-04 15:35:42.000000000 +0000

+++ xen-4.6.1/tools/qemu-xen-traditional/hw/fw_cfg.c	2016-03-06 16:42:33.464296362 +0000

@@ -54,11 +54,15 @@

 static void fw_cfg_write(FWCfgState *s, uint8_t value)

 {

     int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);

-    FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];

+    FWCfgEntry *e = (s->cur_entry == FW_CFG_INVALID) ? NULL :

+                     &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];

     FW_CFG_DPRINTF("write %d\n", value);

-    if (s->cur_entry & FW_CFG_WRITE_CHANNEL && s->cur_offset < e->len) {

+    if (s->cur_entry & FW_CFG_WRITE_CHANNEL

+        && e != NULL

+        && e->callback

+        && s->cur_offset < e->len) {

         e->data[s->cur_offset++] = value;

         if (s->cur_offset == e->len) {

             e->callback(e->callback_opaque, e->data);

@@ -88,7 +92,8 @@

 static uint8_t fw_cfg_read(FWCfgState *s)

 {

     int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);

-    FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];

+    FWCfgEntry *e = (s->cur_entry == FW_CFG_INVALID) ? NULL :

+                    &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];

     uint8_t ret;

     if (s->cur_entry == FW_CFG_INVALID || !e->data || s->cur_offset >= e->len)