diff options
author | Markus Armbruster <armbru@redhat.com> | 2017-03-03 13:32:21 +0100 |
---|---|---|
committer | Markus Armbruster <armbru@redhat.com> | 2017-03-05 09:02:10 +0100 |
commit | 74d8c9d99d1984d78ac8d8e28266525b2b190b8b (patch) | |
tree | 3cf0ebb48486f4250a351226e271bb5ab5547d16 /tests/qmp-test.c | |
parent | 17783ac828adc694d986698d2d7014aedfeb48c6 (diff) | |
download | qemu-74d8c9d99d1984d78ac8d8e28266525b2b190b8b.zip qemu-74d8c9d99d1984d78ac8d8e28266525b2b190b8b.tar.gz qemu-74d8c9d99d1984d78ac8d8e28266525b2b190b8b.tar.bz2 |
qga: Fix crash on non-dictionary QMP argument
The value of key 'arguments' must be a JSON object. qemu-ga neglects
to check, and crashes. To reproduce, send
{ 'execute': 'guest-sync', 'arguments': [] }
to qemu-ga.
do_qmp_dispatch() uses qdict_get_qdict() to get the arguments. When
not a JSON object, this gets a null pointer, which flows through the
generated marshalling function to qobject_input_visitor_new(), where
it fails the assertion. qmp_dispatch_check_obj() needs to catch this
error.
QEMU isn't affected, because it runs qmp_check_input_obj() first,
which basically duplicates qmp_dispatch_check_obj()'s checks, plus the
missing one.
Fix by copying the missing one from qmp_check_input_obj() to
qmp_dispatch_check_obj().
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Cc: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <1488544368-30622-2-git-send-email-armbru@redhat.com>
Diffstat (limited to 'tests/qmp-test.c')
0 files changed, 0 insertions, 0 deletions