Re: [Qemu-devel] [PATCH 2/4] json-streamer: Don't crash when input exceeds nesting limit

[Eric Blake <eblake@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1997 bytes --]

On 10/29/2015 06:44 AM, Markus Armbruster wrote:
> We limit nesting depth and input size to defend against input
> triggering excessive heap or stack memory use (commit 29c75dd
> json-streamer: limit the maximum recursion depth and maximum token
> count).  However, when the nesting limit is exceeded,
> parser_context_peek_token()'s assertion fails.
> 
> Broken in commit 65c0f1e "json-parser: don't replicate tokens at each
> level of recursion".
> 
> To reproduce stuff 1025 open braces or brackets into QMP.
> 
> Fix by taking the error exit instead of the normal one.
> 
> Reported-by: Eric Blake <eblake@redhat.com>
> Signed-off-by: Markus Armbruster <armbru@redhat.com>
> ---
>  qobject/json-streamer.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Eric Blake <eblake@redhat.com>

However, a couple comments about the context:

>    if (type == JSON_ERROR) {
>        goto out_emit_bad;
>    } else if (parser->brace_count < 0 ||
>        parser->bracket_count < 0 ||
>        (parser->brace_count == 0 &&
>         parser->bracket_count == 0)) {
>        goto out_emit;

Should we go to out_emit_bad for brace_count/bracket_count < 0, and save
out_emit only for the case where brace == bracket == 0?  Can we even
trigger negative counts (probably by attempting unpaired "{]]", but will
that trigger earlier errors?)

>    } else if (parser->token_size > MAX_TOKEN_SIZE ||
>               parser->bracket_count > MAX_NESTING ||
>               parser->brace_count > MAX_NESTING) {
>        /* Security consideration, we limit total memory allocated per
object
>         * and the maximum recursion depth that a message can force.
>         */
>        goto out_emit;
>    }
>
>    return;
>
>out_emit_bad:
>    /* clear out token list and tell the parser to emit and error

Typo: s/and error/an error/

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 604 bytes --]