From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1NkJ0m-0004WY-5G for qemu-devel@nongnu.org; Wed, 24 Feb 2010 10:18:52 -0500 Received: from [199.232.76.173] (port=55560 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NkJ0k-0004Vv-W7 for qemu-devel@nongnu.org; Wed, 24 Feb 2010 10:18:51 -0500 Received: from Debian-exim by monty-python.gnu.org with spam-scanned (Exim 4.60) (envelope-from ) id 1NkJ0j-0007Dd-OC for qemu-devel@nongnu.org; Wed, 24 Feb 2010 10:18:50 -0500 Received: from mx1.redhat.com ([209.132.183.28]:50530) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1NkJ0i-0007Cv-Kn for qemu-devel@nongnu.org; Wed, 24 Feb 2010 10:18:49 -0500 Received: from int-mx08.intmail.prod.int.phx2.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o1OFIhGO023789 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 24 Feb 2010 10:18:43 -0500 Received: from localhost.localdomain (dhcp-5-175.str.redhat.com [10.32.5.175]) by int-mx08.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id o1OFIg8b025214 for ; Wed, 24 Feb 2010 10:18:42 -0500 From: Kevin Wolf Date: Wed, 24 Feb 2010 16:17:58 +0100 Message-Id: <1267024678-17225-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PATCH] json-parser: Fix segfault on malformed input List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org If the parser fails to parse the key in parse_pair, it will access a NULL pointer. A simple way to trigger this is sending {foo} via QMP. This patch turns the segfault into a syntax error reply. Signed-off-by: Kevin Wolf --- json-parser.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/json-parser.c b/json-parser.c index f3debcb..579928f 100644 --- a/json-parser.c +++ b/json-parser.c @@ -264,7 +264,7 @@ static int parse_pair(JSONParserContext *ctxt, QDict *dict, QList **tokens, va_l peek = qlist_peek(working); key = parse_value(ctxt, &working, ap); - if (qobject_type(key) != QTYPE_QSTRING) { + if (!key || qobject_type(key) != QTYPE_QSTRING) { parse_error(ctxt, peek, "key is not a string in object"); goto out; } -- 1.6.6.1