[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v2 48/60] json: Enforce token count and size limits
From: |
Markus Armbruster |
Subject: |
[Qemu-devel] [PATCH v2 48/60] json: Enforce token count and size limits more tightly |
Date: |
Fri, 17 Aug 2018 17:05:47 +0200 |
Token count and size limits exist to guard against excessive heap
usage. We check them only after we created the token on the heap.
That's assigning a cowboy to the barn to lasso the horse after it has
bolted. Close the barn door instead: check before we create the
token.
Signed-off-by: Markus Armbruster <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
---
qobject/json-streamer.c | 36 ++++++++++++++++++------------------
1 file changed, 18 insertions(+), 18 deletions(-)
diff --git a/qobject/json-streamer.c b/qobject/json-streamer.c
index 674dfe6e85..810aae521f 100644
--- a/qobject/json-streamer.c
+++ b/qobject/json-streamer.c
@@ -20,7 +20,7 @@
#define MAX_TOKEN_SIZE (64ULL << 20)
#define MAX_TOKEN_COUNT (2ULL << 20)
-#define MAX_NESTING (1ULL << 10)
+#define MAX_NESTING (1 << 10)
static void json_message_free_token(void *token, void *opaque)
{
@@ -71,6 +71,23 @@ void json_message_process_token(JSONLexer *lexer, GString
*input,
break;
}
+ /*
+ * Security consideration, we limit total memory allocated per object
+ * and the maximum recursion depth that a message can force.
+ */
+ if (parser->token_size + input->len + 1 > MAX_TOKEN_SIZE) {
+ error_setg(&err, "JSON token size limit exceeded");
+ goto out_emit;
+ }
+ if (g_queue_get_length(parser->tokens) + 1 > MAX_TOKEN_COUNT) {
+ error_setg(&err, "JSON token count limit exceeded");
+ goto out_emit;
+ }
+ if (parser->bracket_count + parser->brace_count > MAX_NESTING) {
+ error_setg(&err, "JSON nesting depth limit exceeded");
+ goto out_emit;
+ }
+
token = g_malloc(sizeof(JSONToken) + input->len + 1);
token->type = type;
memcpy(token->str, input->str, input->len);
@@ -91,23 +108,6 @@ void json_message_process_token(JSONLexer *lexer, GString
*input,
goto out_emit;
}
- /*
- * Security consideration, we limit total memory allocated per object
- * and the maximum recursion depth that a message can force.
- */
- if (parser->token_size > MAX_TOKEN_SIZE) {
- error_setg(&err, "JSON token size limit exceeded");
- goto out_emit;
- }
- if (g_queue_get_length(parser->tokens) > MAX_TOKEN_COUNT) {
- error_setg(&err, "JSON token count limit exceeded");
- goto out_emit;
- }
- if (parser->bracket_count + parser->brace_count > MAX_NESTING) {
- error_setg(&err, "JSON nesting depth limit exceeded");
- goto out_emit;
- }
-
return;
out_emit:
--
2.17.1
- [Qemu-devel] [PATCH v2 41/60] json: Nicer recovery from invalid leading zero, (continued)
- [Qemu-devel] [PATCH v2 41/60] json: Nicer recovery from invalid leading zero, Markus Armbruster, 2018/08/17
- [Qemu-devel] [PATCH v2 40/60] json: Replace %I64d, %I64u by %PRId64, %PRIu64, Markus Armbruster, 2018/08/17
- [Qemu-devel] [PATCH v2 49/60] json: Streamline json_message_process_token(), Markus Armbruster, 2018/08/17
- [Qemu-devel] [PATCH v2 39/60] json: Leave rejecting invalid interpolation to parser, Markus Armbruster, 2018/08/17
- [Qemu-devel] [PATCH v2 51/60] json: Eliminate lexer state IN_ERROR and pseudo-token JSON_MIN, Markus Armbruster, 2018/08/17
- [Qemu-devel] [PATCH v2 43/60] qjson: Fix qobject_from_json() & friends for multiple values, Markus Armbruster, 2018/08/17
- [Qemu-devel] [PATCH v2 57/60] tests/drive_del-test: Fix harmless JSON interpolation bug, Markus Armbruster, 2018/08/17
- [Qemu-devel] [PATCH v2 48/60] json: Enforce token count and size limits more tightly,
Markus Armbruster <=
- [Qemu-devel] [PATCH v2 56/60] docs/interop/qmp-spec: How to force known good parser state, Markus Armbruster, 2018/08/17
- [Qemu-devel] [PATCH v2 54/60] qobject: Drop superfluous includes of qemu-common.h, Markus Armbruster, 2018/08/17
- [Qemu-devel] [PATCH v2 47/60] qjson: Have qobject_from_json() & friends reject empty and blank, Markus Armbruster, 2018/08/17
- [Qemu-devel] [PATCH v2 55/60] json: Clean up headers, Markus Armbruster, 2018/08/17
- Re: [Qemu-devel] [PATCH v2 00/60] json: Fixes, error reporting improvements, cleanups, no-reply, 2018/08/18