diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2010-02-24 16:17:58 +0100 |
|---|---|---|
| committer | Aurelien Jarno <aurelien@aurel32.net> | 2010-04-09 18:41:59 +0200 |
| commit | 9462695b64ef628e94d7f670feecdaa125ff5f52 (patch) | |
| tree | 9b99ac38609ed77201d6921253a326a6180c781c | |
| parent | 5eb089588ed3e54865fe596531e2375d0a5ab3f0 (diff) | |
json-parser: Fix segfault on malformed input
If the parser fails to parse the key in parse_pair, it will access a NULL
pointer. A simple way to trigger this is sending {foo} via QMP. This patch
turns the segfault into a syntax error reply.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit d758d90fe1f74a46042fca665036a23b4d5fe87d)
| -rw-r--r-- | json-parser.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/json-parser.c b/json-parser.c index 2ab6f6c11b..3497cd365f 100644 --- a/json-parser.c +++ b/json-parser.c @@ -266,7 +266,7 @@ static int parse_pair(JSONParserContext *ctxt, QDict *dict, QList **tokens, va_l peek = qlist_peek(working); key = parse_value(ctxt, &working, ap); - if (qobject_type(key) != QTYPE_QSTRING) { + if (!key || qobject_type(key) != QTYPE_QSTRING) { parse_error(ctxt, peek, "key is not a string in object"); goto out; } |