[Qemu-devel] [RFC] monitor: fix segfault from uninitialized lexer->emit

[Alon Levy]

The following triggers a call to monitor_control_read before
monitor_control_event has been called. This patch is misplaced but
fixes the problem by moving the json_message_parser_init call before
setting the chardev handlers.

(echo '{"execute": "qmp_capabilities"}'; echo '{"execute":"query-spice"}'; echo 
'{ "execute": "quit" }') | qemu-system-x86_64 -spice port=9999 -qmp stdio

Signed-off-by: Alon Levy <address@hidden>
---
 monitor.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/monitor.c b/monitor.c
index 1b8ba2c..6e3d970 100644
--- a/monitor.c
+++ b/monitor.c
@@ -5190,8 +5190,6 @@ static void monitor_control_event(void *opaque, int event)
 
     switch (event) {
     case CHR_EVENT_OPENED:
-        mon->mc->command_mode = 0;
-        json_message_parser_init(&mon->mc->parser, handle_qmp_command);
         data = get_qmp_greeting();
         monitor_json_emitter(mon, data);
         qobject_decref(data);
@@ -5272,6 +5270,8 @@ void monitor_init(CharDriverState *chr, int flags)
 
     if (monitor_ctrl_mode(mon)) {
         mon->mc = qemu_mallocz(sizeof(MonitorControl));
+        mon->mc->command_mode = 0;
+        json_message_parser_init(&mon->mc->parser, handle_qmp_command);
         /* Control mode requires special handlers */
         qemu_chr_add_handlers(chr, monitor_can_read, monitor_control_read,
                               monitor_control_event, mon);
-- 
1.7.6