1394dc0690
We immediately diagnose unbalanced right curly brace:
$ qemu-kvm --nodefaults --nographic --qmp stdio
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 2, "major": 4},
"package": "v5.0.0-rc1-1-gf6ce4a439a08"}, "capabilities": ["oob"]}}
}
{"error": {"class": "GenericError", "desc": "JSON parse error,
expecting value"}}
except within square bracket:
[}
The check for unbalanced braces has a typo. Fix it.
Fixes: 8d3265b3d0
Signed-off-by: Simran Singhal <singhalsimran0@gmail.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <20200402182848.GA3023@simran-Inspiron-5558>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Commit message rewritten to explain what's broken]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
135 lines
3.6 KiB
C
135 lines
3.6 KiB
C
/*
|
|
* JSON streaming support
|
|
*
|
|
* Copyright IBM, Corp. 2009
|
|
*
|
|
* Authors:
|
|
* Anthony Liguori <aliguori@us.ibm.com>
|
|
*
|
|
* This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
|
|
* See the COPYING.LIB file in the top-level directory.
|
|
*
|
|
*/
|
|
|
|
#include "qemu/osdep.h"
|
|
#include "qapi/error.h"
|
|
#include "json-parser-int.h"
|
|
|
|
#define MAX_TOKEN_SIZE (64ULL << 20)
|
|
#define MAX_TOKEN_COUNT (2ULL << 20)
|
|
#define MAX_NESTING (1 << 10)
|
|
|
|
static void json_message_free_tokens(JSONMessageParser *parser)
|
|
{
|
|
JSONToken *token;
|
|
|
|
while ((token = g_queue_pop_head(&parser->tokens))) {
|
|
g_free(token);
|
|
}
|
|
}
|
|
|
|
void json_message_process_token(JSONLexer *lexer, GString *input,
|
|
JSONTokenType type, int x, int y)
|
|
{
|
|
JSONMessageParser *parser = container_of(lexer, JSONMessageParser, lexer);
|
|
QObject *json = NULL;
|
|
Error *err = NULL;
|
|
JSONToken *token;
|
|
|
|
switch (type) {
|
|
case JSON_LCURLY:
|
|
parser->brace_count++;
|
|
break;
|
|
case JSON_RCURLY:
|
|
parser->brace_count--;
|
|
break;
|
|
case JSON_LSQUARE:
|
|
parser->bracket_count++;
|
|
break;
|
|
case JSON_RSQUARE:
|
|
parser->bracket_count--;
|
|
break;
|
|
case JSON_ERROR:
|
|
error_setg(&err, "JSON parse error, stray '%s'", input->str);
|
|
goto out_emit;
|
|
case JSON_END_OF_INPUT:
|
|
if (g_queue_is_empty(&parser->tokens)) {
|
|
return;
|
|
}
|
|
json = json_parser_parse(&parser->tokens, parser->ap, &err);
|
|
goto out_emit;
|
|
default:
|
|
break;
|
|
}
|
|
|
|
/*
|
|
* Security consideration, we limit total memory allocated per object
|
|
* and the maximum recursion depth that a message can force.
|
|
*/
|
|
if (parser->token_size + input->len + 1 > MAX_TOKEN_SIZE) {
|
|
error_setg(&err, "JSON token size limit exceeded");
|
|
goto out_emit;
|
|
}
|
|
if (g_queue_get_length(&parser->tokens) + 1 > MAX_TOKEN_COUNT) {
|
|
error_setg(&err, "JSON token count limit exceeded");
|
|
goto out_emit;
|
|
}
|
|
if (parser->bracket_count + parser->brace_count > MAX_NESTING) {
|
|
error_setg(&err, "JSON nesting depth limit exceeded");
|
|
goto out_emit;
|
|
}
|
|
|
|
token = json_token(type, x, y, input);
|
|
parser->token_size += input->len;
|
|
|
|
g_queue_push_tail(&parser->tokens, token);
|
|
|
|
if ((parser->brace_count > 0 || parser->bracket_count > 0)
|
|
&& parser->brace_count >= 0 && parser->bracket_count >= 0) {
|
|
return;
|
|
}
|
|
|
|
json = json_parser_parse(&parser->tokens, parser->ap, &err);
|
|
|
|
out_emit:
|
|
parser->brace_count = 0;
|
|
parser->bracket_count = 0;
|
|
json_message_free_tokens(parser);
|
|
parser->token_size = 0;
|
|
parser->emit(parser->opaque, json, err);
|
|
}
|
|
|
|
void json_message_parser_init(JSONMessageParser *parser,
|
|
void (*emit)(void *opaque, QObject *json,
|
|
Error *err),
|
|
void *opaque, va_list *ap)
|
|
{
|
|
parser->emit = emit;
|
|
parser->opaque = opaque;
|
|
parser->ap = ap;
|
|
parser->brace_count = 0;
|
|
parser->bracket_count = 0;
|
|
g_queue_init(&parser->tokens);
|
|
parser->token_size = 0;
|
|
|
|
json_lexer_init(&parser->lexer, !!ap);
|
|
}
|
|
|
|
void json_message_parser_feed(JSONMessageParser *parser,
|
|
const char *buffer, size_t size)
|
|
{
|
|
json_lexer_feed(&parser->lexer, buffer, size);
|
|
}
|
|
|
|
void json_message_parser_flush(JSONMessageParser *parser)
|
|
{
|
|
json_lexer_flush(&parser->lexer);
|
|
assert(g_queue_is_empty(&parser->tokens));
|
|
}
|
|
|
|
void json_message_parser_destroy(JSONMessageParser *parser)
|
|
{
|
|
json_lexer_destroy(&parser->lexer);
|
|
json_message_free_tokens(parser);
|
|
}
|