From 150402e71aacfb468234cd309a51c3f9b029b1c9 Mon Sep 17 00:00:00 2001 From: Anthony Liguori Date: Mon, 5 Mar 2012 17:44:32 -0500 Subject: [PATCH 65/98] json-lexer: limit the maximum size of a given token Signed-off-by: Michael Roth Signed-off-by: Anthony Liguori (cherry picked from commit 325601b47b64b33cbe237508df2037e195795497) Signed-off-by: Jeff Cody Signed-off-by: Michal Novotny --- json-lexer.c | 13 +++++++++++++ 1 files changed, 13 insertions(+), 0 deletions(-) diff --git a/json-lexer.c b/json-lexer.c index 65c9720..fe5a060 100644 --- a/json-lexer.c +++ b/json-lexer.c @@ -18,6 +18,8 @@ #include "qemu-common.h" #include "json-lexer.h" +#define MAX_TOKEN_SIZE (64ULL << 20) + /* * \"([^\\\"]|(\\\"\\'\\\\\\/\\b\\f\\n\\r\\t\\u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))*\" * '([^\\']|(\\\"\\'\\\\\\/\\b\\f\\n\\r\\t\\u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))*' @@ -309,6 +311,17 @@ static int json_lexer_feed_char(JSONLexer *lexer, char ch) } lexer->state = new_state; } while (!char_consumed); + + /* Do not let a single token grow to an arbitrarily large size, + * this is a security consideration. + */ + if (lexer->token->length > MAX_TOKEN_SIZE) { + lexer->emit(lexer, lexer->token, lexer->state, lexer->x, lexer->y); + QDECREF(lexer->token); + lexer->token = qstring_new(); + lexer->state = IN_START; + } + return 0; } -- 1.7.7.6