mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

qga: Fix crash on non-dictionary QMP argument

Browse Source 
The value of key 'arguments' must be a JSON object.  qemu-ga neglects
to check, and crashes.  To reproduce, send

    { 'execute': 'guest-sync', 'arguments': [] }

to qemu-ga.

do_qmp_dispatch() uses qdict_get_qdict() to get the arguments.  When
not a JSON object, this gets a null pointer, which flows through the
generated marshalling function to qobject_input_visitor_new(), where
it fails the assertion.  qmp_dispatch_check_obj() needs to catch this
error.

QEMU isn't affected, because it runs qmp_check_input_obj() first,
which basically duplicates qmp_dispatch_check_obj()'s checks, plus the
missing one.

Fix by copying the missing one from qmp_check_input_obj() to
qmp_dispatch_check_obj().

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Cc: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <1488544368-30622-2-git-send-email-armbru@redhat.com>
This commit is contained in:
Markus Armbruster 2017-03-03 13:32:21 +01:00
parent 17783ac828
commit 74d8c9d99d
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
qapi/qmp-dispatch.c
View File

@ -47,7 +47,13 @@ static QDict *qmp_dispatch_check_obj(const QObject *request, Error **errp)
return NULL; return NULL;
} }
has_exec_key = true; has_exec_key = true;
} else if (strcmp(arg_name, "arguments")) { } else if (!strcmp(arg_name, "arguments")) {
if (qobject_type(arg_obj) != QTYPE_QDICT) {
error_setg(errp, QERR_QMP_BAD_INPUT_OBJECT_MEMBER,
"arguments", "object");
return NULL;
}
} else {
error_setg(errp, QERR_QMP_EXTRA_MEMBER, arg_name); error_setg(errp, QERR_QMP_EXTRA_MEMBER, arg_name);
return NULL; return NULL;
} }