diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2010-02-24 16:17:58 +0100 |
|---|---|---|
| committer | Aurelien Jarno <aurelien@aurel32.net> | 2010-03-06 22:32:54 +0100 |
| commit | d758d90fe1f74a46042fca665036a23b4d5fe87d (patch) | |
| tree | 1155cf353a7d181342afd75791c870584d2476fd /json-parser.c | |
| parent | cdee7bdfee37b774c80f698d2d4338670db7c6cb (diff) | |
| download | focaccia-qemu-d758d90fe1f74a46042fca665036a23b4d5fe87d.tar.gz focaccia-qemu-d758d90fe1f74a46042fca665036a23b4d5fe87d.zip | |
json-parser: Fix segfault on malformed input
If the parser fails to parse the key in parse_pair, it will access a NULL
pointer. A simple way to trigger this is sending {foo} via QMP. This patch
turns the segfault into a syntax error reply.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Diffstat (limited to 'json-parser.c')
| -rw-r--r-- | json-parser.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/json-parser.c b/json-parser.c index f3debcb6ef..579928f2ee 100644 --- a/json-parser.c +++ b/json-parser.c @@ -264,7 +264,7 @@ static int parse_pair(JSONParserContext *ctxt, QDict *dict, QList **tokens, va_l peek = qlist_peek(working); key = parse_value(ctxt, &working, ap); - if (qobject_type(key) != QTYPE_QSTRING) { + if (!key || qobject_type(key) != QTYPE_QSTRING) { parse_error(ctxt, peek, "key is not a string in object"); goto out; } |