Hello Marc,
+-- On Thu, 23 May 2019, Marc-André Lureau wrote --+
| I don't see how you could exploit this today.
|
| QMP parser has MAX_TOKEN_COUNT (2ULL << 20).
I see, didn't realise that. I tried to reproduce it and
{"error": {"class": "GenericError", "desc": "JSON token count limit
exceeded"}}
got above error around ~1048570 tokens; Much earlier than 0x200000(=2097152)
as defined by MAX_TOKEN_COUNT. I guess multiple packets are being merged to
form the incoming command and there is a glitch in there.
| We could have "assert(count < MAX_TOKEN_COUNT)" in the loop, if it helps.
No, assert() doesn't seem good.
I think same limit will apply to commands coming via QAPIs as well?
Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
