Re: [Qemu-devel] [PATCH v2] qga: check length of command-line & environment variables

[P J P]

  Hello Marc,

+-- On Thu, 23 May 2019, Marc-André Lureau wrote --+
| I don't see how you could exploit this today.
| 
| QMP parser has MAX_TOKEN_COUNT (2ULL << 20).

I see, didn't realise that. I tried to reproduce it and

   {"error": {"class": "GenericError", "desc": "JSON token count limit 
exceeded"}}

got above error around ~1048570 tokens; Much earlier than 0x200000(=2097152)  
as defined by MAX_TOKEN_COUNT. I guess multiple packets are being merged to 
form the incoming command and there is a glitch in there.

| We could have "assert(count < MAX_TOKEN_COUNT)" in the loop, if it helps.

No, assert() doesn't seem good.

I think same limit will apply to commands coming via QAPIs as well?


Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F