From cee2dedb85b97e4976c83bea84064c3921b8b7ac Mon Sep 17 00:00:00 2001 From: Michael Roth Date: Thu, 18 Sep 2014 15:36:40 -0500 Subject: qapi: add visit_start_union and visit_end_union In some cases an input visitor might bail out on filling out a struct for various reasons, such as missing fields when running in strict mode. In the case of a QAPI Union type, this may lead to cases where the .kind field which encodes the union type is uninitialized. Subsequently, other visitors, such as the dealloc visitor, may use this .kind value as if it were initialized, leading to assumptions about the union type which in this case may lead to segfaults. For example, freeing an integer value. However, we can generally rely on the fact that the always-present .data void * field that we generate for these union types will always be NULL in cases where .kind is uninitialized (at least, there shouldn't be a reason where we'd do this purposefully). So pass this information on to Visitor implementation via these optional start_union/end_union interfaces so this information can be used to guard against the situation above. We will make use of this information in a subsequent patch for the dealloc visitor. Cc: qemu-stable@nongnu.org Reported-by: Fam Zheng Suggested-by: Paolo Bonzini Reviewed-by: Paolo Bonzini Reviewed-by: Eric Blake Signed-off-by: Michael Roth Signed-off-by: Luiz Capitulino --- scripts/qapi-visit.py | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'scripts') diff --git a/scripts/qapi-visit.py b/scripts/qapi-visit.py index df9f7fb657..8f845a2b29 100644 --- a/scripts/qapi-visit.py +++ b/scripts/qapi-visit.py @@ -358,6 +358,9 @@ void visit_type_%(name)s(Visitor *m, %(name)s **obj, const char *name, Error **e if (err) { goto out_obj; } + if (!visit_start_union(m, !!(*obj)->data, &err) || err) { + goto out_obj; + } switch ((*obj)->kind) { ''', disc_type = disc_type, @@ -386,6 +389,9 @@ void visit_type_%(name)s(Visitor *m, %(name)s **obj, const char *name, Error **e out_obj: error_propagate(errp, err); err = NULL; + visit_end_union(m, !!(*obj)->data, &err); + error_propagate(errp, err); + err = NULL; } visit_end_struct(m, &err); out: -- cgit v1.2.3