ovsdb: Fix segfault when a column set contains an invalid column name.

KevinLu233 · Dec 12, 2009 · 99b2042 · 99b2042
1 parent 45a7de5
commit 99b2042
Show file tree

Hide file tree

Showing 3 changed files with 27 additions and 10 deletions.
diff --git a/ovsdb/column.c b/ovsdb/column.c
@@ -143,6 +143,7 @@ ovsdb_column_set_from_json(const struct json *json,
 
         return NULL;
     } else {
+        struct ovsdb_error *error = NULL;
         size_t i;
 
         if (json->type != JSON_ARRAY) {
@@ -152,26 +153,34 @@ ovsdb_column_set_from_json(const struct json *json,
         /* XXX this is O(n**2) */
         for (i = 0; i < json->u.array.n; i++) {
             struct ovsdb_column *column;
+            const char *s;
 
             if (json->u.array.elems[i]->type != JSON_STRING) {
                 goto error;
             }
 
-            column = shash_find_data(&table->schema->columns,
-                                     json->u.array.elems[i]->u.string);
-            if (ovsdb_column_set_contains(set, column->index)) {
+            s = json->u.array.elems[i]->u.string;
+            column = shash_find_data(&table->schema->columns, s);
+            if (!column) {
+                error = ovsdb_syntax_error(json, NULL, "%s is not a valid "
+                                           "column name", s);
+                goto error;
+            } else if (ovsdb_column_set_contains(set, column->index)) {
                 goto error;
             }
             ovsdb_column_set_add(set, column);
         }
-
         return NULL;
-    }
 
-error:
-    ovsdb_column_set_destroy(set);
-    return ovsdb_syntax_error(json, NULL,
-                              "array of distinct column names expected");
+    error:
+        ovsdb_column_set_destroy(set);
+        ovsdb_column_set_init(set);
+        if (!error) {
+            error = ovsdb_syntax_error(json, NULL, "array of distinct column "
+                                       "names expected");
+        }
+        return error;
+    }
 }
 
 struct json *

diff --git a/tests/ovsdb-query.at b/tests/ovsdb-query.at
@@ -533,3 +533,11 @@ query 25: a-a-a
 query 26: ababa
 query 27: a-a-a],
   [query])
+
+OVSDB_CHECK_NEGATIVE([parse colunn set containing bad name],
+  [[query-distinct \
+    '{"columns": {"i": {"type": "integer"}}}' \
+    '[{"i": 0}]' \
+    '[[]]' \
+    '["i", "bad"]']],
+  [bad is not a valid column name])
diff --git a/tests/test-ovsdb.c b/tests/test-ovsdb.c
@@ -791,7 +791,7 @@ do_query_distinct(int argc UNUSED, char *argv[])
 
     /* Parse column set. */
     json = parse_json(argv[4]);
-    ovsdb_column_set_from_json(json, table, &columns);
+    check_ovsdb_error(ovsdb_column_set_from_json(json, table, &columns));
     json_destroy(json);
 
     /* Parse rows, add to table. */