diff options
author | Markus Armbruster <armbru@redhat.com> | 2018-08-23 18:40:12 +0200 |
---|---|---|
committer | Markus Armbruster <armbru@redhat.com> | 2018-08-24 20:26:37 +0200 |
commit | f9277915ee7b2654f5347c4c261c8a0651fdd561 (patch) | |
tree | fdd3e61e5c1e072b9fc24cdb6fac78a4d551d942 | |
parent | e06d008ac833ac220b920f4d8858e6f62f7a59f9 (diff) | |
download | qemu-f9277915ee7b2654f5347c4c261c8a0651fdd561.zip qemu-f9277915ee7b2654f5347c4c261c8a0651fdd561.tar.gz qemu-f9277915ee7b2654f5347c4c261c8a0651fdd561.tar.bz2 |
json: Fix streamer not to ignore trailing unterminated structures
json_message_process_token() accumulates tokens until it got the
sequence of tokens that comprise a single JSON value (it counts curly
braces and square brackets to decide). It feeds those token sequences
to json_parser_parse(). If a non-empty sequence of tokens remains at
the end of the parse, it's silently ignored. check-qjson.c cases
unterminated_array(), unterminated_array_comma(), unterminated_dict(),
unterminated_dict_comma() demonstrate this bug.
Fix as follows. Introduce a JSON_END_OF_INPUT token. When the
streamer receives it, it feeds the accumulated tokens to
json_parser_parse().
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <20180823164025.12553-46-armbru@redhat.com>
-rw-r--r-- | include/qapi/qmp/json-lexer.h | 1 | ||||
-rw-r--r-- | qobject/json-lexer.c | 2 | ||||
-rw-r--r-- | qobject/json-streamer.c | 8 | ||||
-rw-r--r-- | tests/check-qjson.c | 8 |
4 files changed, 15 insertions, 4 deletions
diff --git a/include/qapi/qmp/json-lexer.h b/include/qapi/qmp/json-lexer.h index afa84cb..508fc7b 100644 --- a/include/qapi/qmp/json-lexer.h +++ b/include/qapi/qmp/json-lexer.h @@ -30,6 +30,7 @@ typedef enum json_token_type { JSON_INTERP, JSON_SKIP, JSON_ERROR, + JSON_END_OF_INPUT, } JSONTokenType; typedef struct JSONLexer { diff --git a/qobject/json-lexer.c b/qobject/json-lexer.c index 01417dc..a728c32 100644 --- a/qobject/json-lexer.c +++ b/qobject/json-lexer.c @@ -347,6 +347,8 @@ void json_lexer_flush(JSONLexer *lexer) if (lexer->state != lexer->start_state) { json_lexer_feed_char(lexer, 0, true); } + json_message_process_token(lexer, lexer->token, JSON_END_OF_INPUT, + lexer->x, lexer->y); } void json_lexer_destroy(JSONLexer *lexer) diff --git a/qobject/json-streamer.c b/qobject/json-streamer.c index e372ecc..674dfe6 100644 --- a/qobject/json-streamer.c +++ b/qobject/json-streamer.c @@ -60,6 +60,13 @@ void json_message_process_token(JSONLexer *lexer, GString *input, case JSON_ERROR: error_setg(&err, "JSON parse error, stray '%s'", input->str); goto out_emit; + case JSON_END_OF_INPUT: + if (g_queue_is_empty(parser->tokens)) { + return; + } + json = json_parser_parse(parser->tokens, parser->ap, &err); + parser->tokens = NULL; + goto out_emit; default: break; } @@ -137,6 +144,7 @@ void json_message_parser_feed(JSONMessageParser *parser, void json_message_parser_flush(JSONMessageParser *parser) { json_lexer_flush(&parser->lexer); + assert(g_queue_is_empty(parser->tokens)); } void json_message_parser_destroy(JSONMessageParser *parser) diff --git a/tests/check-qjson.c b/tests/check-qjson.c index f943837..0ca4b3c 100644 --- a/tests/check-qjson.c +++ b/tests/check-qjson.c @@ -1360,7 +1360,7 @@ static void unterminated_array(void) { Error *err = NULL; QObject *obj = qobject_from_json("[32", &err); - g_assert(!err); /* BUG */ + error_free_or_abort(&err); g_assert(obj == NULL); } @@ -1368,7 +1368,7 @@ static void unterminated_array_comma(void) { Error *err = NULL; QObject *obj = qobject_from_json("[32,", &err); - g_assert(!err); /* BUG */ + error_free_or_abort(&err); g_assert(obj == NULL); } @@ -1384,7 +1384,7 @@ static void unterminated_dict(void) { Error *err = NULL; QObject *obj = qobject_from_json("{'abc':32", &err); - g_assert(!err); /* BUG */ + error_free_or_abort(&err); g_assert(obj == NULL); } @@ -1392,7 +1392,7 @@ static void unterminated_dict_comma(void) { Error *err = NULL; QObject *obj = qobject_from_json("{'abc':32,", &err); - g_assert(!err); /* BUG */ + error_free_or_abort(&err); g_assert(obj == NULL); } |