From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36249) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bnAmX-0000Wc-Gq for qemu-devel@nongnu.org; Thu, 22 Sep 2016 16:39:46 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bnAmW-0001dA-Kw for qemu-devel@nongnu.org; Thu, 22 Sep 2016 16:39:45 -0400 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Fri, 23 Sep 2016 00:39:26 +0400 Message-Id: <20160922203927.28241-3-marcandre.lureau@redhat.com> In-Reply-To: <20160922203927.28241-1-marcandre.lureau@redhat.com> References: <20160922203927.28241-1-marcandre.lureau@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PATCH v4 2/3] qapi: fix crash when a parameter is missing List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: paolo.bonzini@gmail.com, berrange@redhat.com, qemu-stable@nongnu.org, eblake@redhat.com, armbru@redhat.com, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Calling: { "execute": "qom-set", "arguments": { "path": "/machine", "property": "rtc-time" } } Will crash with: qapi/qapi-visit-core.c:277: visit_type_any: Assertion `!err !=3D !*obj' failed Clear the obj and return an error. The patch also fixes a similar potential crash in qmp_input_type_null() by checking qmp_input_get_object() returned a valid qobj. Signed-off-by: Marc-Andr=C3=A9 Lureau Reviewed-by: Eric Blake --- qapi/qmp-input-visitor.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/qapi/qmp-input-visitor.c b/qapi/qmp-input-visitor.c index 64dd392..fc91e74 100644 --- a/qapi/qmp-input-visitor.c +++ b/qapi/qmp-input-visitor.c @@ -338,6 +338,12 @@ static void qmp_input_type_any(Visitor *v, const cha= r *name, QObject **obj, QmpInputVisitor *qiv =3D to_qiv(v); QObject *qobj =3D qmp_input_get_object(qiv, name, true); =20 + if (!qobj) { + error_setg(errp, QERR_MISSING_PARAMETER, name ? name : "null"); + *obj =3D NULL; + return; + } + qobject_incref(qobj); *obj =3D qobj; } @@ -347,6 +353,11 @@ static void qmp_input_type_null(Visitor *v, const ch= ar *name, Error **errp) QmpInputVisitor *qiv =3D to_qiv(v); QObject *qobj =3D qmp_input_get_object(qiv, name, true); =20 + if (!qobj) { + error_setg(errp, QERR_MISSING_PARAMETER, name ? name : "null"); + return; + } + if (qobject_type(qobj) !=3D QTYPE_QNULL) { error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : "nul= l", "null"); --=20 2.10.0