On Mon, Jun 22, 2015 at 15:01:15 -0600, Eric Blake wrote: > Since older yajl ignores trailing garbage, a client can cause > problems by intentionally ending the wrapper array early. Since > we already track nesting, it's not too much harder to reject > invalid nesting pops. > > * src/util/virjson. (_virJSONParser): Add field. > (virJSONValueFromString): Set witness. > (virJSONParserHandleEndArray): Use it to catch abuse. > * tests/jsontest.c (mymain): Test it. > > Signed-off-by: Eric Blake <[email protected]> > --- > > Could be squashed with 3/3, if desired. > > src/util/virjson.c | 7 +++++-- > tests/jsontest.c | 1 + > 2 files changed, 6 insertions(+), 2 deletions(-) > > diff --git a/src/util/virjson.c b/src/util/virjson.c > index a33005a..3c6ed34 100644 > --- a/src/util/virjson.c > +++ b/src/util/virjson.c > @@ -64,6 +64,7 @@ struct _virJSONParser { > virJSONValuePtr head; > virJSONParserStatePtr state; > size_t nstate; > + int wrap;
Boolean?
> };
>
>
> @@ -1556,7 +1557,7 @@ virJSONParserHandleEndArray(void *ctx)
>
> VIR_DEBUG("parser=%p", parser);
>
> - if (!parser->nstate)
> + if (!(parser->nstate - parser->wrap))
Yuck! This really covers up what's happening here.
if ((parser->nstate == 1 && parser->wrap) ||
(parser->nstate == 0 && !parser->wrap))
It takes two lines but you at least don't cover up the logic.
> return 0;
>
> state = &(parser->state[parser->nstate-1]);
> @@ -1591,7 +1592,7 @@ virJSONValuePtr
> virJSONValueFromString(const char *jsonstring)
> {
> yajl_handle hand;
> - virJSONParser parser = { NULL, NULL, 0 };
> + virJSONParser parser = { NULL, NULL, 0, 0 };
> virJSONValuePtr ret = NULL;
> int rc;
> size_t len = strlen(jsonstring);
> @@ -1627,8 +1628,10 @@ virJSONValueFromString(const char *jsonstring)
> rc = yajl_parse(hand, (const unsigned char *)jsonstring, len);
> # else
> rc = yajl_parse(hand, (const unsigned char *)"[", 1);
> + parser.wrap = 1;
True?
> if (VIR_YAJL_STATUS_OK(rc))
> rc = yajl_parse(hand, (const unsigned char *)jsonstring, len);
> + parser.wrap = 0;
False?
> if (VIR_YAJL_STATUS_OK(rc))
> rc = yajl_parse(hand, (const unsigned char *)"]", 1);
> # endif
Peter
signature.asc
Description: Digital signature
-- libvir-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/libvir-list
