OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
bbc0586ced
qemu-e2k/tests
History
Christophe Fergeau bbc0586ced json: Fix % handling when not interpolating 
Commit 8bca4613 added support for %% in json strings when interpolating,
but in doing so broke handling of % when not interpolating.

When parse_string() is fed a string token containing '%', it skips the
'%' regardless of ctxt->ap, i.e. even it's not interpolating.  If the
'%' is the string's last character, it fails an assertion.  Else, it
"merely" swallows the '%'.

Fix parse_string() to handle '%' specially only when interpolating.

To gauge the bug's impact, let's review non-interpolating users of this
parser, i.e. code passing NULL context to json_message_parser_init():

* tests/check-qjson.c, tests/test-qobject-input-visitor.c,
  tests/test-visitor-serialization.c

  Plenty of tests, but we still failed to cover the buggy case.

* monitor.c: QMP input

* qga/main.c: QGA input

* qobject_from_json():

  - qobject-input-visitor.c: JSON command line option arguments of
    -display and -blockdev

    Reproducer: -blockdev '{"%"}'

  - block.c: JSON pseudo-filenames starting with "json:"

    Reproducer: https://bugzilla.redhat.com/show_bug.cgi?id=1668244#c3

  - block/rbd.c: JSON key pairs

    Pseudo-filenames starting with "rbd:".

Command line, QMP and QGA input are trusted.

Filenames are trusted when they come from command line, QMP or HMP.
They are untrusted when they come from from image file headers.
Example: QCOW2 backing file name.  Note that this is *not* the security
boundary between host and guest.  It's the boundary between host and an
image file from an untrusted source.

Neither failing an assertion nor skipping a character in a filename of
your choice looks exploitable.  Note that we don't support compiling
with NDEBUG.

Fixes: 8bca4613e6
Cc: qemu-stable@nongnu.org
Signed-off-by: Christophe Fergeau <cfergeau@redhat.com>
Message-Id: <20190102140535.11512-1-cfergeau@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Tested-by: Richard W.M. Jones <rjones@redhat.com>
[Commit message extended to discuss impact]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2019-01-24 15:20:59 +01:00
..
acceptance Acceptance tests: add Linux initrd checking test 2019-01-17 17:52:40 -02:00
data acpi: update expected files 2019-01-17 21:10:57 -05:00
decode
docker tests/docker: remove SID_AGE test hack 2019-01-14 14:52:30 +00:00
fp Clean up includes 2018-12-20 10:29:08 +01:00
guest-debug tests/guest-debug: fix scoping of failcount 2018-11-13 10:47:59 +00:00
image-fuzzer
keys
libqos qemu/queue.h: simplify reverse access to QTAILQ 2019-01-11 15:46:55 +01:00
migration
multiboot
qapi-schema qapi: add condition to variants documentation 2018-12-14 06:52:48 +01:00
qemu-iotests iotests: Enhance 223, 233 to cover 'qemu-nbd --list' 2019-01-21 15:49:52 -06:00
rocker
tcg avoid TABs in files that only contain a few 2019-01-11 15:46:56 +01:00
vm
vmstate-static-checker-data
.gitignore
ac97-test.c
acpi-utils.c tests: acpi: reuse fetch_table() in vmgenid-test 2019-01-17 21:10:57 -05:00
acpi-utils.h tests: acpi: use AcpiSdtTable::aml instead of AcpiSdtTable::header::signature 2019-01-17 21:10:57 -05:00
ahci-test.c
atomic64-bench.c tests: use g_usleep instead of rem = sleep(time) 2019-01-14 14:52:30 +00:00
atomic_add-bench.c tests: use g_usleep instead of rem = sleep(time) 2019-01-14 14:52:30 +00:00
benchmark-crypto-cipher.c
benchmark-crypto-hash.c
benchmark-crypto-hmac.c
bios-tables-test.c tests: acpi: use AcpiSdtTable::aml instead of AcpiSdtTable::header::signature 2019-01-17 21:10:57 -05:00
boot-order-test.c tests/boot-order: Make test independent of global_qtest 2019-01-22 05:14:32 +01:00
boot-sector.c
boot-sector.h
boot-serial-test.c tests: Exit boot-serial-test loop if child dies 2018-12-17 15:37:50 +01:00
cdrom-test.c test: execute g_test_run when tests are skipped 2019-01-11 13:57:25 +01:00
check-block-qdict.c
check-block.sh qemu-iotests: convert pwd and $(pwd) to $PWD 2018-11-19 10:08:19 -06:00
check-qdict.c
check-qjson.c json: Fix % handling when not interpolating 2019-01-24 15:20:59 +01:00
check-qlist.c
check-qlit.c
check-qnull.c
check-qnum.c
check-qobject.c
check-qom-interface.c qom: make interface types abstract 2018-12-11 15:45:22 -02:00
check-qom-proplist.c
check-qstring.c
cpu-plug-test.c hw/i386: Remove deprecated machines pc-0.10 and pc-0.11 2018-12-20 11:19:12 -05:00
crypto-tls-psk-helpers.c
crypto-tls-psk-helpers.h
crypto-tls-x509-helpers.c
crypto-tls-x509-helpers.h
device-introspect-test.c
display-vga-test.c tests/display-vga: Enable virtio-vga test 2019-01-11 11:45:00 +01:00
drive_del-test.c
ds1338-test.c
e1000-test.c
e1000e-test.c
eepro100-test.c
endianness-test.c tests/endianesss: Make test independent of global_qtest 2019-01-22 05:14:32 +01:00
es1370-test.c
fdc-test.c
fw_cfg-test.c
hd-geo-test.c
hexloader-test.c tests/hexloader-test: Don't pass -nographic to the QEMU under test 2019-01-22 06:26:32 +01:00
i440fx-test.c
i82801b11-test.c
ide-test.c tests/ide: Free pcibus when finishing a test 2018-11-19 21:59:44 +01:00
intel-hda-test.c
io-channel-helpers.c
io-channel-helpers.h
ioh3420-test.c
iothread.c
iothread.h
ipmi-bt-test.c
ipmi-kcs-test.c
ipoctal232-test.c
ivshmem-test.c hw/misc/ivshmem: Remove deprecated "ivshmem" legacy device 2019-01-14 19:31:04 -05:00
libqtest.c qtest: Add set_irq_in command to set IRQ/GPIO level 2019-01-07 15:23:47 +00:00
libqtest.h qtest: Add set_irq_in command to set IRQ/GPIO level 2019-01-07 15:23:47 +00:00
m25p80-test.c
m48t59-test.c
machine-none-test.c tests/machine-none: Make test independent of global_qtest 2018-12-17 15:36:40 +01:00
Makefile.include qapi: Eliminate indirection through qmp_event_get_func_emit() 2019-01-24 10:01:05 +01:00
megasas-test.c
microbit-test.c tests/microbit-test: Add Tests for nRF51 Timer 2019-01-07 15:23:47 +00:00
migration-test.c test: execute g_test_run when tests are skipped 2019-01-11 13:57:25 +01:00
ne2000-test.c
numa-test.c
nvme-test.c nvme: fix out-of-bounds access to the CMB 2018-11-22 16:43:52 +01:00
pca9552-test.c
pcnet-test.c
pkix_asn1_tab.c
pnv-xscom-test.c tests/pnv-xscom: Make test independent of global_qtest 2019-01-22 05:14:32 +01:00
prom-env-test.c tests/prom-env: Make test independent of global_qtest 2018-12-17 15:36:40 +01:00
ptimer-test-stubs.c
ptimer-test.c
ptimer-test.h
pvpanic-test.c tests/pvpanic: Make the pvpanic test independent of global_qtest 2018-12-17 15:36:40 +01:00
pxe-test.c tests/pxe: Make test independent of global_qtest 2018-12-17 15:36:40 +01:00
q35-test.c
qemu-iotests-quick.sh
qht-bench.c tests: use g_usleep instead of rem = sleep(time) 2019-01-14 14:52:30 +00:00
qmp-cmd-test.c
qmp-test.c Revert "tests: Add parameter to qtest_init_without_qmp_handshake" 2018-12-12 10:28:27 +01:00
qom-test.c
rcutorture.c
requirements.txt Acceptance tests: add make rule for running them 2018-10-30 21:13:54 -03:00
rtas-test.c
rtc-test.c
rtl8139-test.c
sdhci-test.c
socket-helpers.c
socket-helpers.h
spapr-phb-test.c
tco-test.c
test-aio-multithread.c
test-aio.c
test-arm-mptimer.c tests/test-arm-mptimer: Don't leak string memory 2018-12-14 13:30:54 +00:00
test-base64.c
test-bdrv-drain.c
test-bitcnt.c
test-bitops.c
test-block-backend.c
test-blockjob-txn.c
test-blockjob.c
test-bufferiszero.c
test-char.c tests/test-char: Check websocket chardev functionality 2018-11-01 12:13:09 +04:00
test-clone-visitor.c
test-coroutine.c
test-crypto-afsplit.c
test-crypto-block.c crypto: support multiple threads accessing one QCryptoBlock 2018-12-12 11:16:49 +00:00
test-crypto-cipher.c
test-crypto-hash.c
test-crypto-hmac.c
test-crypto-ivgen.c
test-crypto-pbkdf.c test: execute g_test_run when tests are skipped 2019-01-11 13:57:25 +01:00
test-crypto-secret.c
test-crypto-tlscredsx509.c
test-crypto-tlssession.c
test-crypto-xts.c
test-cutils.c cutils: Fix qemu_strtosz() & friends to reject non-finite sizes 2018-12-13 19:10:06 +01:00
test-filter-mirror.c tests/test-filter: Make tests independent of global_qtest 2018-12-17 15:36:40 +01:00
test-filter-redirector.c tests/test-filter: Make tests independent of global_qtest 2018-12-17 15:36:40 +01:00
test-hbitmap.c Revert "hbitmap: Add @advance param to hbitmap_iter_next()" 2019-01-15 18:26:50 -05:00
test-hmp.c
test-image-locking.c tests: Add unit tests for image locking 2018-11-12 17:46:57 +01:00
test-int128.c
test-io-channel-buffer.c
test-io-channel-command.c
test-io-channel-file.c
test-io-channel-socket.c
test-io-channel-tls.c
test-io-task.c
test-iov.c
test-keyval.c
test-logging.c
test-mul64.c
test-netfilter.c
test-opts-visitor.c
test-qapi-util.c
test-qdev-global-props.c qdev: all globals are now user-provided 2019-01-07 16:18:42 +04:00
test-qdist.c
test-qemu-opts.c
test-qga.c
test-qht-par.c
test-qht.c
test-qmp-cmds.c tests: add oob functional test for test-qmp-cmds 2018-12-12 10:28:27 +01:00
test-qmp-event.c qapi: Eliminate indirection through qmp_event_get_func_emit() 2019-01-24 10:01:05 +01:00
test-qobject-input-visitor.c
test-qobject-output-visitor.c
test-rcu-list.c qemu/queue.h: leave head structs anonymous unless necessary 2019-01-11 15:46:55 +01:00
test-rcu-simpleq.c
test-rcu-tailq.c
test-replication.c
test-shift128.c
test-string-input-visitor.c test-string-input-visitor: Add range overflow tests 2018-12-13 19:10:06 +01:00
test-string-output-visitor.c
test-thread-pool.c
test-throttle.c
test-timed-average.c
test-util-sockets.c
test-uuid.c
test-visitor-serialization.c
test-vmstate.c qemu/queue.h: simplify reverse access to QTAILQ 2019-01-11 15:46:55 +01:00
test-write-threshold.c
test-x86-cpuid-compat.c
test-x86-cpuid.c
test-xbzrle.c
tmp105-test.c
tpci200-test.c
tpm-crb-swtpm-test.c
tpm-crb-test.c
tpm-emu.c
tpm-emu.h
tpm-tests.c tests: tpm: Use g_test_message rather than fprintf 2018-11-14 16:12:24 -05:00
tpm-tests.h
tpm-tis-swtpm-test.c
tpm-tis-test.c
tpm-util.c
tpm-util.h Clean up includes 2018-12-20 10:29:08 +01:00
usb-hcd-ehci-test.c
usb-hcd-ohci-test.c
usb-hcd-uhci-test.c
usb-hcd-xhci-test.c
vhost-user-bridge.c Clean up includes 2018-12-20 10:29:08 +01:00
vhost-user-test.c tests: vhost-user-test: initialize 'fd' in chr_read 2019-01-14 19:31:04 -05:00
virtio-9p-test.c
virtio-balloon-test.c
virtio-blk-test.c
virtio-ccw-test.c
virtio-console-test.c
virtio-net-test.c virtio-net-test: add large tx buffer test 2018-12-04 11:06:15 +00:00
virtio-rng-test.c
virtio-scsi-test.c
virtio-serial-test.c
vmgenid-test.c tests: acpi: reuse fetch_table() in vmgenid-test 2019-01-17 21:10:57 -05:00
vmxnet3-test.c
wdt_ib700-test.c