From 9462695b64ef628e94d7f670feecdaa125ff5f52 Mon Sep 17 00:00:00 2001 From: Kevin Wolf Date: Wed, 24 Feb 2010 16:17:58 +0100 Subject: [PATCH] json-parser: Fix segfault on malformed input If the parser fails to parse the key in parse_pair, it will access a NULL pointer. A simple way to trigger this is sending {foo} via QMP. This patch turns the segfault into a syntax error reply. Signed-off-by: Kevin Wolf Signed-off-by: Aurelien Jarno (cherry picked from commit d758d90fe1f74a46042fca665036a23b4d5fe87d) --- json-parser.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/json-parser.c b/json-parser.c index 2ab6f6c11b..3497cd365f 100644 --- a/json-parser.c +++ b/json-parser.c @@ -266,7 +266,7 @@ static int parse_pair(JSONParserContext *ctxt, QDict *dict, QList **tokens, va_l peek = qlist_peek(working); key = parse_value(ctxt, &working, ap); - if (qobject_type(key) != QTYPE_QSTRING) { + if (!key || qobject_type(key) != QTYPE_QSTRING) { parse_error(ctxt, peek, "key is not a string in object"); goto out; } -- GitLab