From: Ben Pfaff <blp@nicira.com>
Date: Sat, 12 Dec 2009 00:37:29 +0000 (-0800)
Subject: ovsdb: Fix segfault when a column set contains an invalid column name.
X-Git-Url: https://pintos-os.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=99b2042d3beb2528dc0e6176a8c264b2f977ad1d;p=openvswitch

ovsdb: Fix segfault when a column set contains an invalid column name.
---

diff --git a/ovsdb/column.c b/ovsdb/column.c
index dc93dc71..73dc9c24 100644
--- a/ovsdb/column.c
+++ b/ovsdb/column.c
@@ -143,6 +143,7 @@ ovsdb_column_set_from_json(const struct json *json,
 
         return NULL;
     } else {
+        struct ovsdb_error *error = NULL;
         size_t i;
 
         if (json->type != JSON_ARRAY) {
@@ -152,26 +153,34 @@ ovsdb_column_set_from_json(const struct json *json,
         /* XXX this is O(n**2) */
         for (i = 0; i < json->u.array.n; i++) {
             struct ovsdb_column *column;
+            const char *s;
 
             if (json->u.array.elems[i]->type != JSON_STRING) {
                 goto error;
             }
 
-            column = shash_find_data(&table->schema->columns,
-                                     json->u.array.elems[i]->u.string);
-            if (ovsdb_column_set_contains(set, column->index)) {
+            s = json->u.array.elems[i]->u.string;
+            column = shash_find_data(&table->schema->columns, s);
+            if (!column) {
+                error = ovsdb_syntax_error(json, NULL, "%s is not a valid "
+                                           "column name", s);
+                goto error;
+            } else if (ovsdb_column_set_contains(set, column->index)) {
                 goto error;
             }
             ovsdb_column_set_add(set, column);
         }
-
         return NULL;
-    }
 
-error:
-    ovsdb_column_set_destroy(set);
-    return ovsdb_syntax_error(json, NULL,
-                              "array of distinct column names expected");
+    error:
+        ovsdb_column_set_destroy(set);
+        ovsdb_column_set_init(set);
+        if (!error) {
+            error = ovsdb_syntax_error(json, NULL, "array of distinct column "
+                                       "names expected");
+        }
+        return error;
+    }
 }
 
 struct json *
diff --git a/tests/ovsdb-query.at b/tests/ovsdb-query.at
index c39aa121..2c2b648d 100644
--- a/tests/ovsdb-query.at
+++ b/tests/ovsdb-query.at
@@ -533,3 +533,11 @@ query 25: a-a-a
 query 26: ababa
 query 27: a-a-a],
   [query])
+
+OVSDB_CHECK_NEGATIVE([parse colunn set containing bad name],
+  [[query-distinct \
+    '{"columns": {"i": {"type": "integer"}}}' \
+    '[{"i": 0}]' \
+    '[[]]' \
+    '["i", "bad"]']],
+  [bad is not a valid column name])
diff --git a/tests/test-ovsdb.c b/tests/test-ovsdb.c
index 4f44afe8..a4a5f019 100644
--- a/tests/test-ovsdb.c
+++ b/tests/test-ovsdb.c
@@ -791,7 +791,7 @@ do_query_distinct(int argc UNUSED, char *argv[])
 
     /* Parse column set. */
     json = parse_json(argv[4]);
-    ovsdb_column_set_from_json(json, table, &columns);
+    check_ovsdb_error(ovsdb_column_set_from_json(json, table, &columns));
     json_destroy(json);
 
     /* Parse rows, add to table. */