qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [RFC] New Migration Protocol using Visitor Interface


From: Michael S. Tsirkin
Subject: Re: [Qemu-devel] [RFC] New Migration Protocol using Visitor Interface
Date: Mon, 3 Oct 2011 16:18:54 +0200
User-agent: Mutt/1.5.21 (2010-09-15)

On Mon, Oct 03, 2011 at 08:48:05AM -0500, Anthony Liguori wrote:
> On 10/03/2011 08:30 AM, Michael S. Tsirkin wrote:
> >On Mon, Oct 03, 2011 at 08:18:31AM -0500, Anthony Liguori wrote:
> >>On 10/03/2011 08:10 AM, Stefan Berger wrote:
> >>>I am doing that. Indefinite length encoding *would* be a problem because 
> >>>you
> >>>cannot push the size onto the stack so that you could skip to the end of 
> >>>the
> >>>structure.
> >>
> >>For an indefinite length encoding, you just have to keep reading the
> >>stream at end_struct until you hit the canary tag ignoring anything
> >>you encounter.
> >>
> >>Regards,
> >>
> >>Anthony Liguori
> >
> >That's not exactly right: one indefinite length encoding can be nested
> >within the other. So what we must do is keep reading, read out,
> >decode and skip regular length encodings, and count the
> >nesting of indefinite length encodings. When we see bit 7 set,
> >we increase nesting. When we see end of content, we descrease nesting.
> >Stop when nesting reaches 0.
> 
> Yes, you basically have a skip field in the Visitor.  If skip is
> set, then don't actually marshal to anything.  So:
> 
> type_int (et al.)
>   if (!skip) {
>      store to passed in int
>   }
>   increment offset
> 
> Then when you want to skip to the end of the indefinite, you do something 
> like:
> 
> skip_indefinite:
>   while tag != CANARY:
>     if tag == INT:
>       visit_type_int(v, NULL, NULL, errp);
>     elif tag == STRING:
>       visit_type_str(v, NULL, NULL, errp);
>     elif tag == INDEFINITE:
>       visit_start_struct(v, NULL, NULL, errp);
>       skip_indefinite(v, errp);
>       visit_end_struct(v, NULL, NULL, errp);
> 
> end_struct:
>   v->skip = true;
>   skip_indefinite(v, errp);
>   v->skip = false;
> 
> Regards,
> 
> Anthony Liguori

This implementation is recursive, which has the problem
of wasting unlimited resources to skip bad input.
And we really do not need to look at tag at all. Just
the length.

-- 
MST



reply via email to

[Prev in Thread] Current Thread [Next in Thread]