The JSON parser happily accepts duplicate object member names.  The
last value wins.  Reproducer #1:

    $ qemu-system-x86_64 -qmp stdio
    {"QMP": {"version": {"qemu": {"micro": 93, "minor": 0, "major": 3},
    "package": "v3.1.0-rc3-7-g87a45d86ed"}, "capabilities": []}}
    {'execute':'qmp_capabilities'}
    {"return": {}}
    {'execute':'blockdev-add','arguments':{'driver':'null-co',
     'node-name':'foo','node-name':'bar'}}
    {"return": {}}
    {'execute':'query-named-block-nodes'}
    {"return": [{ [...] "node-name": "bar" [...] }]}

Reproducer #2 is iotest 229.

Fix the parser to reject duplicates, and fix iotest 229 not to use
them.

Reported-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qobject/json-parser.c  | 5 +++++
 tests/qemu-iotests/229 | 1 -
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/qobject/json-parser.c b/qobject/json-parser.c
index 5a840dfd86..a86de3f462 100644
--- a/qobject/json-parser.c
+++ b/qobject/json-parser.c
@@ -288,6 +288,11 @@ static int parse_pair(JSONParserContext *ctxt, QDict *dict)
         goto out;
     }
 
+    if (qdict_haskey(dict, qstring_get_str(key))) {
+        parse_error(ctxt, token, "duplicate key");
+        goto out;
+    }
+        
     qdict_put_obj(dict, qstring_get_str(key), value);
 
     qobject_unref(key);
diff --git a/tests/qemu-iotests/229 b/tests/qemu-iotests/229
index 86602437ff..893d098ad2 100755
--- a/tests/qemu-iotests/229
+++ b/tests/qemu-iotests/229
@@ -69,7 +69,6 @@ echo
 _send_qemu_cmd $QEMU_HANDLE \
     "{'execute': 'drive-mirror',
                  'arguments': {'device': 'testdisk',
-                               'mode':   'absolute-paths',
                                'format': '$IMGFMT',
                                'target': '$DEST_IMG',
                                'sync':   'full',
-- 
2.17.2

On Thu, Dec 06, 2018 at 01:17:43PM +0100, Markus Armbruster wrote:
> The JSON parser happily accepts duplicate object member names.  The
> last value wins.  Reproducer #1:
> 
>     $ qemu-system-x86_64 -qmp stdio
>     {"QMP": {"version": {"qemu": {"micro": 93, "minor": 0, "major": 3},
>     "package": "v3.1.0-rc3-7-g87a45d86ed"}, "capabilities": []}}
>     {'execute':'qmp_capabilities'}
>     {"return": {}}
>     {'execute':'blockdev-add','arguments':{'driver':'null-co',
>      'node-name':'foo','node-name':'bar'}}
>     {"return": {}}
>     {'execute':'query-named-block-nodes'}
>     {"return": [{ [...] "node-name": "bar" [...] }]}
> 
> Reproducer #2 is iotest 229.
> 
> Fix the parser to reject duplicates, and fix iotest 229 not to use
> them.
> 
> Reported-by: Max Reitz <mreitz@redhat.com>
> Signed-off-by: Markus Armbruster <armbru@redhat.com>
> ---
>  qobject/json-parser.c  | 5 +++++
>  tests/qemu-iotests/229 | 1 -
>  2 files changed, 5 insertions(+), 1 deletion(-)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

On 12/6/18 1:17 PM, Markus Armbruster wrote:
> The JSON parser happily accepts duplicate object member names.  The
> last value wins.  Reproducer #1:
> 
>     $ qemu-system-x86_64 -qmp stdio
>     {"QMP": {"version": {"qemu": {"micro": 93, "minor": 0, "major": 3},
>     "package": "v3.1.0-rc3-7-g87a45d86ed"}, "capabilities": []}}
>     {'execute':'qmp_capabilities'}
>     {"return": {}}
>     {'execute':'blockdev-add','arguments':{'driver':'null-co',
>      'node-name':'foo','node-name':'bar'}}
>     {"return": {}}
>     {'execute':'query-named-block-nodes'}
>     {"return": [{ [...] "node-name": "bar" [...] }]}
> 
> Reproducer #2 is iotest 229.
> 
> Fix the parser to reject duplicates, and fix iotest 229 not to use
> them.

Looks like 2 different patches.

> 
> Reported-by: Max Reitz <mreitz@redhat.com>
> Signed-off-by: Markus Armbruster <armbru@redhat.com>
> ---
>  qobject/json-parser.c  | 5 +++++
>  tests/qemu-iotests/229 | 1 -
>  2 files changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/qobject/json-parser.c b/qobject/json-parser.c
> index 5a840dfd86..a86de3f462 100644
> --- a/qobject/json-parser.c
> +++ b/qobject/json-parser.c
> @@ -288,6 +288,11 @@ static int parse_pair(JSONParserContext *ctxt, QDict *dict)
>          goto out;
>      }
>  
> +    if (qdict_haskey(dict, qstring_get_str(key))) {
> +        parse_error(ctxt, token, "duplicate key");
> +        goto out;
> +    }
> +        
>      qdict_put_obj(dict, qstring_get_str(key), value);
>  
>      qobject_unref(key);
> diff --git a/tests/qemu-iotests/229 b/tests/qemu-iotests/229
> index 86602437ff..893d098ad2 100755
> --- a/tests/qemu-iotests/229
> +++ b/tests/qemu-iotests/229
> @@ -69,7 +69,6 @@ echo
>  _send_qemu_cmd $QEMU_HANDLE \
>      "{'execute': 'drive-mirror',
>                   'arguments': {'device': 'testdisk',
> -                               'mode':   'absolute-paths',
>                                 'format': '$IMGFMT',
>                                 'target': '$DEST_IMG',
>                                 'sync':   'full',
> 

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Philippe Mathieu-Daudé <philmd@redhat.com> writes:

> On 12/6/18 1:17 PM, Markus Armbruster wrote:
>> The JSON parser happily accepts duplicate object member names.  The
>> last value wins.  Reproducer #1:
>> 
>>     $ qemu-system-x86_64 -qmp stdio
>>     {"QMP": {"version": {"qemu": {"micro": 93, "minor": 0, "major": 3},
>>     "package": "v3.1.0-rc3-7-g87a45d86ed"}, "capabilities": []}}
>>     {'execute':'qmp_capabilities'}
>>     {"return": {}}
>>     {'execute':'blockdev-add','arguments':{'driver':'null-co',
>>      'node-name':'foo','node-name':'bar'}}
>>     {"return": {}}
>>     {'execute':'query-named-block-nodes'}
>>     {"return": [{ [...] "node-name": "bar" [...] }]}
>> 
>> Reproducer #2 is iotest 229.
>> 
>> Fix the parser to reject duplicates, and fix iotest 229 not to use
>> them.
>
> Looks like 2 different patches.

I admit it does.  But the iotest one is trivial, so I decided to squash
it in.

>> Reported-by: Max Reitz <mreitz@redhat.com>
>> Signed-off-by: Markus Armbruster <armbru@redhat.com>
>> ---
>>  qobject/json-parser.c  | 5 +++++
>>  tests/qemu-iotests/229 | 1 -
>>  2 files changed, 5 insertions(+), 1 deletion(-)
>> 
>> diff --git a/qobject/json-parser.c b/qobject/json-parser.c
>> index 5a840dfd86..a86de3f462 100644
>> --- a/qobject/json-parser.c
>> +++ b/qobject/json-parser.c
>> @@ -288,6 +288,11 @@ static int parse_pair(JSONParserContext *ctxt, QDict *dict)
>>          goto out;
>>      }
>>  
>> +    if (qdict_haskey(dict, qstring_get_str(key))) {
>> +        parse_error(ctxt, token, "duplicate key");
>> +        goto out;
>> +    }
>> +        
>>      qdict_put_obj(dict, qstring_get_str(key), value);
>>  
>>      qobject_unref(key);
>> diff --git a/tests/qemu-iotests/229 b/tests/qemu-iotests/229
>> index 86602437ff..893d098ad2 100755
>> --- a/tests/qemu-iotests/229
>> +++ b/tests/qemu-iotests/229
>> @@ -69,7 +69,6 @@ echo
>>  _send_qemu_cmd $QEMU_HANDLE \
>>      "{'execute': 'drive-mirror',
>>                   'arguments': {'device': 'testdisk',
>> -                               'mode':   'absolute-paths',
>>                                 'format': '$IMGFMT',
>>                                 'target': '$DEST_IMG',
>>                                 'sync':   'full',
>> 
>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Thanks!

Patchew URL: https://patchew.org/QEMU/20181206121743.20762-1-armbru@redhat.com/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Type: series
Subject: [Qemu-devel] [PATCH] json: Fix to reject duplicate object member names
Message-id: 20181206121743.20762-1-armbru@redhat.com

=== TEST SCRIPT BEGIN ===
#!/bin/bash

BASE=base
n=1
total=$(git log --oneline $BASE.. | wc -l)
failed=0

git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram

commits="$(git log --format=%H --reverse $BASE..)"
for c in $commits; do
    echo "Checking PATCH $n/$total: $(git log -n 1 --format=%s $c)..."
    if ! git show $c --format=email | ./scripts/checkpatch.pl --mailback -; then
        failed=1
        echo
    fi
    n=$((n+1))
done

exit $failed
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
Switched to a new branch 'test'
a2c0ac9 json: Fix to reject duplicate object member names

=== OUTPUT BEGIN ===
Checking PATCH 1/1: json: Fix to reject duplicate object member names...
ERROR: trailing whitespace
#41: FILE: qobject/json-parser.c:295:
+        $

total: 1 errors, 0 warnings, 18 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

=== OUTPUT END ===

Test command exited with code: 1


The full log is available at
http://patchew.org/logs/20181206121743.20762-1-armbru@redhat.com/testing.checkpatch/?type=message.
---
Email generated automatically by Patchew [http://patchew.org/].
Please send your feedback to patchew-devel@redhat.com

Markus Armbruster <armbru@redhat.com> writes:

> The JSON parser happily accepts duplicate object member names.  The
> last value wins.  Reproducer #1:
>
>     $ qemu-system-x86_64 -qmp stdio
>     {"QMP": {"version": {"qemu": {"micro": 93, "minor": 0, "major": 3},
>     "package": "v3.1.0-rc3-7-g87a45d86ed"}, "capabilities": []}}
>     {'execute':'qmp_capabilities'}
>     {"return": {}}
>     {'execute':'blockdev-add','arguments':{'driver':'null-co',
>      'node-name':'foo','node-name':'bar'}}
>     {"return": {}}
>     {'execute':'query-named-block-nodes'}
>     {"return": [{ [...] "node-name": "bar" [...] }]}
>
> Reproducer #2 is iotest 229.
>
> Fix the parser to reject duplicates, and fix iotest 229 not to use
> them.
>
> Reported-by: Max Reitz <mreitz@redhat.com>
> Signed-off-by: Markus Armbruster <armbru@redhat.com>

Queued.