Commit 74d8c9d9 authored Mar 03, 2017 by Markus Armbruster

qga: Fix crash on non-dictionary QMP argument



The value of key 'arguments' must be a JSON object.  qemu-ga neglects
to check, and crashes.  To reproduce, send

    { 'execute': 'guest-sync', 'arguments': [] }

to qemu-ga.

do_qmp_dispatch() uses qdict_get_qdict() to get the arguments.  When
not a JSON object, this gets a null pointer, which flows through the
generated marshalling function to qobject_input_visitor_new(), where
it fails the assertion.  qmp_dispatch_check_obj() needs to catch this
error.

QEMU isn't affected, because it runs qmp_check_input_obj() first,
which basically duplicates qmp_dispatch_check_obj()'s checks, plus the
missing one.

Fix by copying the missing one from qmp_check_input_obj() to
qmp_dispatch_check_obj().

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Cc: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <1488544368-30622-2-git-send-email-armbru@redhat.com>

parent 17783ac8

qapi/qmp-dispatch.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -47,7 +47,13 @@ static QDict qmp_dispatch_check_obj(const QObject request, Error **errp)
		return NULL;
		}
		has_exec_key = true;
		} else if (strcmp(arg_name, "arguments")) {
		} else if (!strcmp(arg_name, "arguments")) {
		if (qobject_type(arg_obj) != QTYPE_QDICT) {
		error_setg(errp, QERR_QMP_BAD_INPUT_OBJECT_MEMBER,
		"arguments", "object");
		return NULL;
		}
		} else {
		error_setg(errp, QERR_QMP_EXTRA_MEMBER, arg_name);
		return NULL;
		}