From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:40897) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QRwWP-0008Sy-Mq for qemu-devel@nongnu.org; Wed, 01 Jun 2011 21:16:26 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QRwWN-0007v0-KY for qemu-devel@nongnu.org; Wed, 01 Jun 2011 21:16:25 -0400 Received: from mout.perfora.net ([74.208.4.195]:59923) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QRp35-0007sT-UJ for qemu-devel@nongnu.org; Wed, 01 Jun 2011 13:17:40 -0400 From: Michael Roth Date: Wed, 1 Jun 2011 12:14:53 -0500 Message-Id: <1306948500-15086-8-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1306948500-15086-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1306948500-15086-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH v1][ 07/14] json-streamer: limit the maximum recursion depth and maximum token count List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: aliguori@linux.vnet.ibm.com, Jes.Sorensen@redhat.com, agl@linux.vnet.ibm.com, mdroth@linux.vnet.ibm.com, lcapitulino@redhat.com From: Anthony Liguori Signed-off-by: Michael Roth --- json-streamer.c | 17 +++++++++++++++++ 1 files changed, 17 insertions(+), 0 deletions(-) diff --git a/json-streamer.c b/json-streamer.c index 549e9b7..6b9af63 100644 --- a/json-streamer.c +++ b/json-streamer.c @@ -18,6 +18,9 @@ #include "json-lexer.h" #include "json-streamer.h" +#define MAX_TOKEN_SIZE (64ULL << 20) +#define MAX_NESTING (1ULL << 10) + static void json_message_process_token(JSONLexer *lexer, QString *token, JSONTokenType type, int x, int y) { JSONMessageParser *parser = container_of(lexer, JSONMessageParser, lexer); @@ -49,6 +52,8 @@ static void json_message_process_token(JSONLexer *lexer, QString *token, JSONTok qdict_put(dict, "x", qint_from_int(x)); qdict_put(dict, "y", qint_from_int(y)); + parser->token_size += token->length; + qlist_append(parser->tokens, dict); if (parser->brace_count < 0 || @@ -60,6 +65,17 @@ static void json_message_process_token(JSONLexer *lexer, QString *token, JSONTok parser->emit(parser, parser->tokens); QDECREF(parser->tokens); parser->tokens = qlist_new(); + } else if (parser->token_size > MAX_TOKEN_SIZE || + parser->bracket_count > MAX_NESTING || + parser->brace_count > MAX_NESTING) { + /* Security consideration, we limit total memory allocated per object + * and the maximum recursion depth that a message can force. + */ + parser->brace_count = 0; + parser->bracket_count = 0; + parser->emit(parser, parser->tokens); + QDECREF(parser->tokens); + parser->tokens = qlist_new(); } } @@ -70,6 +86,7 @@ void json_message_parser_init(JSONMessageParser *parser, parser->brace_count = 0; parser->bracket_count = 0; parser->tokens = qlist_new(); + parser->token_size = 0; json_lexer_init(&parser->lexer, json_message_process_token); } -- 1.7.0.4