From 6e85e420fb924f7b56f0ce96a11f6fd609c6c02e Mon Sep 17 00:00:00 2001 From: Eric Blake Date: Mon, 19 Feb 2018 16:21:14 -0500 Subject: [PATCH] qapi: Document shortcoming with union 'data' branch Add a FIXME to remind us to fully audit whether removing the 'void *data' branch of each qapi union type can be done safely. Backports commit ca56a822dd538017715345cbbe1f8829e0cc2742 from qemu --- qemu/scripts/qapi-types.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/qemu/scripts/qapi-types.py b/qemu/scripts/qapi-types.py index 9cd710ae..5e95586d 100644 --- a/qemu/scripts/qapi-types.py +++ b/qemu/scripts/qapi-types.py @@ -217,6 +217,14 @@ struct %(name)s ''', discriminator_type_name=c_name(discriminator_type_name)) + # FIXME: What purpose does data serve, besides preventing a union that + # has a branch named 'data'? We use it in qapi-visit.py to decide + # whether to bypass the switch statement if visiting the discriminator + # failed; but since we 0-initialize structs, and cannot tell what + # branch of the union is in use if the discriminator is invalid, there + # should not be any data leaks even without a data pointer. Or, if + # 'data' is merely added to guarantee we don't have an empty union, + # shouldn't we enforce that at .json parse time? ret += mcgen(''' union { /* union tag is @%(c_name)s */ void *data;