]> git.ipfire.org Git - thirdparty/qemu.git/commit - qapi/qmp-dispatch.c
qga: Fix crash on non-dictionary QMP argument
authorMarkus Armbruster <armbru@redhat.com>
Fri, 3 Mar 2017 12:32:21 +0000 (13:32 +0100)
committerMarkus Armbruster <armbru@redhat.com>
Sun, 5 Mar 2017 08:02:10 +0000 (09:02 +0100)
commit74d8c9d99d1984d78ac8d8e28266525b2b190b8b
tree3cf0ebb48486f4250a351226e271bb5ab5547d16
parent17783ac828adc694d986698d2d7014aedfeb48c6
qga: Fix crash on non-dictionary QMP argument

The value of key 'arguments' must be a JSON object.  qemu-ga neglects
to check, and crashes.  To reproduce, send

    { 'execute': 'guest-sync', 'arguments': [] }

to qemu-ga.

do_qmp_dispatch() uses qdict_get_qdict() to get the arguments.  When
not a JSON object, this gets a null pointer, which flows through the
generated marshalling function to qobject_input_visitor_new(), where
it fails the assertion.  qmp_dispatch_check_obj() needs to catch this
error.

QEMU isn't affected, because it runs qmp_check_input_obj() first,
which basically duplicates qmp_dispatch_check_obj()'s checks, plus the
missing one.

Fix by copying the missing one from qmp_check_input_obj() to
qmp_dispatch_check_obj().

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Cc: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <1488544368-30622-2-git-send-email-armbru@redhat.com>
qapi/qmp-dispatch.c