qemu-e2k/qobject
Alex Chen 922d42bb0d json: Fix a memleak in parse_pair()
In qobject_type(), NULL is returned when the 'QObject' returned from parse_value() is not of QString type,
and this 'QObject' memory will leaked.
So we need to first cache the 'QObject' returned from parse_value(), and finally
free 'QObject' memory at the end of the function.
Also, we add a testcast about invalid dict key.

The memleak stack is as follows:
Direct leak of 32 byte(s) in 1 object(s) allocated from:
    #0 0xfffe4b3c34fb in __interceptor_malloc (/lib64/libasan.so.4+0xd34fb)
    #1 0xfffe4ae48aa3 in g_malloc (/lib64/libglib-2.0.so.0+0x58aa3)
    #2 0xaaab3557d9f7 in qnum_from_int qemu/qobject/qnum.c:25
    #3 0xaaab35584d23 in parse_literal qemu/qobject/json-parser.c:511
    #4 0xaaab35584d23 in parse_value qemu/qobject/json-parser.c:554
    #5 0xaaab35583d77 in parse_pair qemu/qobject/json-parser.c:270
    #6 0xaaab355845db in parse_object qemu/qobject/json-parser.c:327
    #7 0xaaab355845db in parse_value qemu/qobject/json-parser.c:546
    #8 0xaaab35585b1b in json_parser_parse qemu/qobject/json-parser.c:580
    #9 0xaaab35583703 in json_message_process_token qemu/qobject/json-streamer.c:92
    #10 0xaaab355ddccf in json_lexer_feed_char qemu/qobject/json-lexer.c:313
    #11 0xaaab355de0eb in json_lexer_feed qemu/qobject/json-lexer.c:350
    #12 0xaaab354aff67 in tcp_chr_read qemu/chardev/char-socket.c:525
    #13 0xfffe4ae429db in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x529db)
    #14 0xfffe4ae42d8f  (/lib64/libglib-2.0.so.0+0x52d8f)
    #15 0xfffe4ae430df in g_main_loop_run (/lib64/libglib-2.0.so.0+0x530df)
    #16 0xaaab34d70bff in iothread_run qemu/iothread.c:82
    #17 0xaaab3559d71b in qemu_thread_start qemu/util/qemu-thread-posix.c:519

Fixes: 532fb53284 ("qapi: Make more of qobject_to()")
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20201113145525.85151-1-alex.chen@huawei.com>
[Commit message tweaked]
2020-11-17 15:39:53 +01:00
..
block-qdict.c qobject: Catch another straggler for use of qdict_put_str() 2018-10-26 17:17:32 +02:00
json-lexer.c json: Fix off-by-one assert check in next_state() 2019-03-26 08:10:11 +01:00
json-parser-int.h json: Eliminate lexer state IN_WHITESPACE, pseudo-token JSON_SKIP 2018-09-24 18:08:07 +02:00
json-parser.c json: Fix a memleak in parse_pair() 2020-11-17 15:39:53 +01:00
json-streamer.c json: Fix check for unbalanced right curly brace 2020-04-07 13:10:11 +02:00
meson.build libqemuutil, qapi, trace: convert to meson 2020-08-21 06:30:08 -04:00
qbool.c qobject: Drop superfluous includes of qemu-common.h 2018-08-24 20:26:37 +02:00
qdict.c qemu/: fix some comment spelling errors 2020-09-17 20:35:43 +02:00
qjson.c qobject: Eliminate qdict_iter(), use qdict_first(), qdict_next() 2020-04-30 06:51:15 +02:00
qlist.c qobject: Eliminate qlist_iter(), use QLIST_FOREACH_ENTRY() instead 2020-04-30 06:51:15 +02:00
qlit.c
qnull.c qobject: Drop superfluous includes of qemu-common.h 2018-08-24 20:26:37 +02:00
qnum.c qobject: Drop superfluous includes of qemu-common.h 2018-08-24 20:26:37 +02:00
qobject.c qobject: Drop superfluous includes of qemu-common.h 2018-08-24 20:26:37 +02:00
qstring.c qstring: add qstring_free() 2020-01-24 20:59:13 +01:00