commit d758d90fe1f74a46042fca665036a23b4d5fe87d
author Kevin Wolf <kwolf@redhat.com> Wed Feb 24 16:17:58 2010 +0100
committer Aurelien Jarno <aurelien@aurel32.net> Sat Mar 06 22:32:54 2010 +0100
tree 1155cf353a7d181342afd75791c870584d2476fd
parent cdee7bdfee37b774c80f698d2d4338670db7c6cb

json-parser: Fix segfault on malformed input

If the parser fails to parse the key in parse_pair, it will access a NULL
pointer. A simple way to trigger this is sending {foo} via QMP. This patch
turns the segfault into a syntax error reply.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

json-parser.c

diff --git a/json-parser.c b/json-parser.c
index f3debcb..579928f 100644
--- a/json-parser.c
+++ b/json-parser.c
@@ -264,7 +264,7 @@
 
     peek = qlist_peek(working);
     key = parse_value(ctxt, &working, ap);
-    if (qobject_type(key) != QTYPE_QSTRING) {
+    if (!key || qobject_type(key) != QTYPE_QSTRING) {
         parse_error(ctxt, peek, "key is not a string in object");
         goto out;
     }