|
 |
34b321 |
From a781053c1b5084ba32b86229b98b9601c990722c Mon Sep 17 00:00:00 2001
|
|
|
34b321 |
From: Markus Armbruster <armbru@redhat.com>
|
|
|
34b321 |
Date: Wed, 27 Jul 2016 07:35:13 +0200
|
|
|
34b321 |
Subject: [PATCH 15/16] json-streamer: fix double-free on exiting during a
|
|
|
34b321 |
parse
|
|
|
34b321 |
|
|
|
34b321 |
RH-Author: Markus Armbruster <armbru@redhat.com>
|
|
|
34b321 |
Message-id: <1469604913-12442-17-git-send-email-armbru@redhat.com>
|
|
|
34b321 |
Patchwork-id: 71484
|
|
|
34b321 |
O-Subject: [RHEL-7.3 qemu-kvm PATCH v2 15/15] json-streamer: fix double-free on exiting during a parse
|
|
|
34b321 |
Bugzilla: 1276036
|
|
|
34b321 |
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
34b321 |
RH-Acked-by: John Snow <jsnow@redhat.com>
|
|
|
34b321 |
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
34b321 |
|
|
|
34b321 |
From: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
34b321 |
|
|
|
34b321 |
Now that json-streamer tries not to leak tokens on incomplete parse,
|
|
|
34b321 |
the tokens can be freed twice if QEMU destroys the json-streamer
|
|
|
34b321 |
object during the parser->emit call. To fix this, create the new
|
|
|
34b321 |
empty GQueue earlier, so that it is already in place when the old
|
|
|
34b321 |
one is passed to parser->emit.
|
|
|
34b321 |
|
|
|
34b321 |
Reported-by: Changlong Xie <xiecl.fnst@cn.fujitsu.com>
|
|
|
34b321 |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
34b321 |
Message-Id: <1467636059-12557-1-git-send-email-pbonzini@redhat.com>
|
|
|
34b321 |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
34b321 |
(cherry picked from commit a942d8fa01f65279cdc135f4294db611bbc088ef)
|
|
|
34b321 |
Signed-off-by: Markus Armbruster <armbru@redhat.com>
|
|
|
34b321 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
34b321 |
---
|
|
|
34b321 |
qobject/json-streamer.c | 8 ++++++--
|
|
|
34b321 |
1 file changed, 6 insertions(+), 2 deletions(-)
|
|
|
34b321 |
|
|
|
34b321 |
diff --git a/qobject/json-streamer.c b/qobject/json-streamer.c
|
|
|
34b321 |
index 3c7d6be..7d041e1 100644
|
|
|
34b321 |
--- a/qobject/json-streamer.c
|
|
|
34b321 |
+++ b/qobject/json-streamer.c
|
|
|
34b321 |
@@ -38,6 +38,7 @@ static void json_message_process_token(JSONLexer *lexer, GString *input,
|
|
|
34b321 |
{
|
|
|
34b321 |
JSONMessageParser *parser = container_of(lexer, JSONMessageParser, lexer);
|
|
|
34b321 |
JSONToken *token;
|
|
|
34b321 |
+ GQueue *tokens;
|
|
|
34b321 |
|
|
|
34b321 |
switch (type) {
|
|
|
34b321 |
case JSON_LCURLY:
|
|
|
34b321 |
@@ -95,9 +96,12 @@ out_emit:
|
|
|
34b321 |
/* send current list of tokens to parser and reset tokenizer */
|
|
|
34b321 |
parser->brace_count = 0;
|
|
|
34b321 |
parser->bracket_count = 0;
|
|
|
34b321 |
- /* parser->emit takes ownership of parser->tokens. */
|
|
|
34b321 |
- parser->emit(parser, parser->tokens);
|
|
|
34b321 |
+ /* parser->emit takes ownership of parser->tokens. Remove our own
|
|
|
34b321 |
+ * reference to parser->tokens before handing it out to parser->emit.
|
|
|
34b321 |
+ */
|
|
|
34b321 |
+ tokens = parser->tokens;
|
|
|
34b321 |
parser->tokens = g_queue_new();
|
|
|
34b321 |
+ parser->emit(parser, tokens);
|
|
|
34b321 |
parser->token_size = 0;
|
|
|
34b321 |
}
|
|
|
34b321 |
|
|
|
34b321 |
--
|
|
|
34b321 |
1.8.3.1
|
|
|
34b321 |
|