Re: [Qemu-devel] [PATCH 1/4] json-streamer: Apply nesting limit more sanely

[Eric Blake]

On 10/29/2015 06:44 AM, Markus Armbruster wrote:
> The nesting limit from commit 29c75dd "json-streamer: limit the
> maximum recursion depth and maximum token count" applies separately to
> braces and brackets.  This makes no sense.  Apply it to their sum,
> because that's actually a measure of recursion depth.
> 
> Signed-off-by: Markus Armbruster <address@hidden>
> ---
>  qobject/json-streamer.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)

Reviewed-by: Eric Blake <address@hidden>

> 
> diff --git a/qobject/json-streamer.c b/qobject/json-streamer.c
> index 1b2f9b1..dced2c7 100644
> --- a/qobject/json-streamer.c
> +++ b/qobject/json-streamer.c
> @@ -64,8 +64,7 @@ static void json_message_process_token(JSONLexer *lexer, 
> QString *token, JSONTok
>           parser->bracket_count == 0)) {
>          goto out_emit;
>      } else if (parser->token_size > MAX_TOKEN_SIZE ||
> -               parser->bracket_count > MAX_NESTING ||
> -               parser->brace_count > MAX_NESTING) {
> +               parser->bracket_count + parser->brace_count > MAX_NESTING) {
>          /* Security consideration, we limit total memory allocated per object
>           * and the maximum recursion depth that a message can force.
>           */
> 

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

signature.asc
Description: OpenPGP digital signature