Commit f9277915 authored by Markus Armbruster's avatar Markus Armbruster
Browse files

json: Fix streamer not to ignore trailing unterminated structures 



json_message_process_token() accumulates tokens until it got the
sequence of tokens that comprise a single JSON value (it counts curly
braces and square brackets to decide).  It feeds those token sequences
to json_parser_parse().  If a non-empty sequence of tokens remains at
the end of the parse, it's silently ignored.  check-qjson.c cases
unterminated_array(), unterminated_array_comma(), unterminated_dict(),
unterminated_dict_comma() demonstrate this bug.

Fix as follows.  Introduce a JSON_END_OF_INPUT token.  When the
streamer receives it, it feeds the accumulated tokens to
json_parser_parse().

Signed-off-by: default avatarMarkus Armbruster <armbru@redhat.com>
Reviewed-by: default avatarEric Blake <eblake@redhat.com>
Message-Id: <20180823164025.12553-46-armbru@redhat.com>
parent e06d008a

include/qapi/qmp/json-lexer.h

+1 −0
Original line number Diff line number Diff line
@@ -30,6 +30,7 @@ typedef enum json_token_type { 
    JSON_INTERP,

    JSON_SKIP,

    JSON_ERROR,

    JSON_END_OF_INPUT,

} JSONTokenType;



typedef struct JSONLexer {

qobject/json-lexer.c

+2 −0
Original line number Diff line number Diff line
@@ -347,6 +347,8 @@ void json_lexer_flush(JSONLexer *lexer) 
    if (lexer->state != lexer->start_state) {

        json_lexer_feed_char(lexer, 0, true);

    }

    json_message_process_token(lexer, lexer->token, JSON_END_OF_INPUT,

                               lexer->x, lexer->y);

}



void json_lexer_destroy(JSONLexer *lexer)

qobject/json-streamer.c

+8 −0
Original line number Diff line number Diff line
@@ -60,6 +60,13 @@ void json_message_process_token(JSONLexer *lexer, GString *input, 
    case JSON_ERROR:

        error_setg(&err, "JSON parse error, stray '%s'", input->str);

        goto out_emit;

    case JSON_END_OF_INPUT:

        if (g_queue_is_empty(parser->tokens)) {

            return;

        }

        json = json_parser_parse(parser->tokens, parser->ap, &err);

        parser->tokens = NULL;

        goto out_emit;

    default:

        break;

    }
@@ -137,6 +144,7 @@ void json_message_parser_feed(JSONMessageParser *parser, 
void json_message_parser_flush(JSONMessageParser *parser)

{

    json_lexer_flush(&parser->lexer);

    assert(g_queue_is_empty(parser->tokens));

}



void json_message_parser_destroy(JSONMessageParser *parser)

tests/check-qjson.c

+4 −4
Original line number Diff line number Diff line
@@ -1360,7 +1360,7 @@ static void unterminated_array(void) 
{

    Error *err = NULL;

    QObject *obj = qobject_from_json("[32", &err);

    g_assert(!err);             /* BUG */

    error_free_or_abort(&err);

    g_assert(obj == NULL);

}
@@ -1368,7 +1368,7 @@ static void unterminated_array_comma(void) 
{

    Error *err = NULL;

    QObject *obj = qobject_from_json("[32,", &err);

    g_assert(!err);             /* BUG */

    error_free_or_abort(&err);

    g_assert(obj == NULL);

}
@@ -1384,7 +1384,7 @@ static void unterminated_dict(void) 
{

    Error *err = NULL;

    QObject *obj = qobject_from_json("{'abc':32", &err);

    g_assert(!err);             /* BUG */

    error_free_or_abort(&err);

    g_assert(obj == NULL);

}
@@ -1392,7 +1392,7 @@ static void unterminated_dict_comma(void) 
{

    Error *err = NULL;

    QObject *obj = qobject_from_json("{'abc':32,", &err);

    g_assert(!err);             /* BUG */

    error_free_or_abort(&err);

    g_assert(obj == NULL);

}