diff mbox

json-parser: Fix potential NULL pointer segfault

Message ID 1346699951-27559-1-git-send-email-sw@weilnetz.de
State Accepted
Headers show

Commit Message

Stefan Weil Sept. 3, 2012, 7:19 p.m. UTC
Report from smatch:
json-parser.c:474 parse_object(62) error: potential null derefence 'dict'.
json-parser.c:553 parse_array(75) error: potential null derefence 'list'.

Label 'out' in json-parser.c can be called with list == NULL
which is passed to QDECREF.

Modify QDECREF to handle a NULL argument (inline function qobject_decref
already handles them, too).

Signed-off-by: Stefan Weil <sw@weilnetz.de>
---

I did not change QINCREF because there are currently no errors caused
by that rarely used macro.

This patch can be used instead of the previous patch which fixed
the problem directly in json-parser.c
(see http://patchwork.ozlabs.org/patch/181129/).

Regards,
Stefan Weil

 qobject.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Luiz Capitulino Sept. 3, 2012, 8:50 p.m. UTC | #1
On Mon,  3 Sep 2012 21:19:11 +0200
Stefan Weil <sw@weilnetz.de> wrote:

> Report from smatch:
> json-parser.c:474 parse_object(62) error: potential null derefence 'dict'.
> json-parser.c:553 parse_array(75) error: potential null derefence 'list'.
> 
> Label 'out' in json-parser.c can be called with list == NULL
> which is passed to QDECREF.
> 
> Modify QDECREF to handle a NULL argument (inline function qobject_decref
> already handles them, too).
> 
> Signed-off-by: Stefan Weil <sw@weilnetz.de>

Applied to qmp-next branch, thanks!

> ---
> 
> I did not change QINCREF because there are currently no errors caused
> by that rarely used macro.
> 
> This patch can be used instead of the previous patch which fixed
> the problem directly in json-parser.c
> (see http://patchwork.ozlabs.org/patch/181129/).
> 
> Regards,
> Stefan Weil
> 
>  qobject.h |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/qobject.h b/qobject.h
> index d42386d..9124649 100644
> --- a/qobject.h
> +++ b/qobject.h
> @@ -71,7 +71,7 @@ typedef struct QObject {
>  
>  /* High-level interface for qobject_decref() */
>  #define QDECREF(obj)              \
> -    qobject_decref(QOBJECT(obj))
> +    qobject_decref(obj ? QOBJECT(obj) : NULL)
>  
>  /* Initialize an object to default values */
>  #define QOBJECT_INIT(obj, qtype_type)   \
diff mbox

Patch

diff --git a/qobject.h b/qobject.h
index d42386d..9124649 100644
--- a/qobject.h
+++ b/qobject.h
@@ -71,7 +71,7 @@  typedef struct QObject {
 
 /* High-level interface for qobject_decref() */
 #define QDECREF(obj)              \
-    qobject_decref(QOBJECT(obj))
+    qobject_decref(obj ? QOBJECT(obj) : NULL)
 
 /* Initialize an object to default values */
 #define QOBJECT_INIT(obj, qtype_type)   \