--- qemu/qapi/qmp-output-visitor.c	2018/04/24 19:02:57	1.1
+++ qemu/qapi/qmp-output-visitor.c	2018/04/24 19:31:16	1.1.1.2
@@ -20,6 +20,7 @@
 typedef struct QStackEntry
 {
     QObject *value;
+    bool is_list_head;
     QTAILQ_ENTRY(QStackEntry) node;
 } QStackEntry;
 
@@ -42,9 +43,12 @@ static QmpOutputVisitor *to_qov(Visitor
 
 static void qmp_output_push_obj(QmpOutputVisitor *qov, QObject *value)
 {
-    QStackEntry *e = qemu_mallocz(sizeof(*e));
+    QStackEntry *e = g_malloc0(sizeof(*e));
 
     e->value = value;
+    if (qobject_type(e->value) == QTYPE_QLIST) {
+        e->is_list_head = true;
+    }
     QTAILQ_INSERT_HEAD(&qov->stack, e, node);
 }
 
@@ -54,7 +58,7 @@ static QObject *qmp_output_pop(QmpOutput
     QObject *value;
     QTAILQ_REMOVE(&qov->stack, e, node);
     value = e->value;
-    qemu_free(e);
+    g_free(e);
     return value;
 }
 
@@ -122,12 +126,20 @@ static void qmp_output_start_list(Visito
     qmp_output_push(qov, list);
 }
 
-static GenericList *qmp_output_next_list(Visitor *v, GenericList **list,
+static GenericList *qmp_output_next_list(Visitor *v, GenericList **listp,
                                          Error **errp)
 {
-    GenericList *retval = *list;
-    *list = retval->next;
-    return retval;
+    GenericList *list = *listp;
+    QmpOutputVisitor *qov = to_qov(v);
+    QStackEntry *e = QTAILQ_FIRST(&qov->stack);
+
+    assert(e);
+    if (e->is_list_head) {
+        e->is_list_head = false;
+        return list;
+    }
+
+    return list ? list->next : NULL;
 }
 
 static void qmp_output_end_list(Visitor *v, Error **errp)
@@ -178,7 +190,7 @@ static void qmp_output_type_enum(Visitor
 
     assert(strings);
     while (strings[i++] != NULL);
-    if (value >= i - 1) {
+    if (value < 0 || value >= i - 1) {
         error_set(errp, QERR_INVALID_PARAMETER, name ? name : "null");
         return;
     }
@@ -210,17 +222,17 @@ void qmp_output_visitor_cleanup(QmpOutpu
         if (e->value) {
             qobject_decref(e->value);
         }
-        qemu_free(e);
+        g_free(e);
     }
 
-    qemu_free(v);
+    g_free(v);
 }
 
 QmpOutputVisitor *qmp_output_visitor_new(void)
 {
     QmpOutputVisitor *v;
 
-    v = qemu_mallocz(sizeof(*v));
+    v = g_malloc0(sizeof(*v));
 
     v->visitor.start_struct = qmp_output_start_struct;
     v->visitor.end_struct = qmp_output_end_struct;