diff --git a/src/qemu/qemu_qapi.c b/src/qemu/qemu_qapi.c index 0226d6c659..93fcae0d44 100644 --- a/src/qemu/qemu_qapi.c +++ b/src/qemu/qemu_qapi.c @@ -74,9 +74,23 @@ struct virQEMUQAPISchemaTraverseContext { virHashTablePtr schema; char **queries; virJSONValuePtr returnType; + size_t depth; }; +static int +virQEMUQAPISchemaTraverseContextValidateDepth(struct virQEMUQAPISchemaTraverseContext *ctxt) +{ + if (ctxt->depth++ > 1000) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("possible loop in QMP schema")); + return -1; + } + + return 0; +} + + static void virQEMUQAPISchemaTraverseContextInit(struct virQEMUQAPISchemaTraverseContext *ctxt, char **queries, @@ -329,6 +343,9 @@ virQEMUQAPISchemaTraverse(const char *baseName, const char *metatype; size_t i; + if (virQEMUQAPISchemaTraverseContextValidateDepth(ctxt) < 0) + return -2; + if (!(cur = virHashLookup(ctxt->schema, baseName))) return -2;