json: improve json parsing
spa_json_get_string() will never write more than maxlen. Use spa_json_parse_stringn() to perform destination length checking.
This commit is contained in:
@@ -62,7 +62,7 @@ json_object_find (const char *obj, const char *key, char *value, size_t len)
|
||||
if (spa_json_enter_object(&it[0], &it[1]) <= 0)
|
||||
return -EINVAL;
|
||||
|
||||
while (spa_json_get_string(&it[1], k, sizeof(k)-1) > 0) {
|
||||
while (spa_json_get_string(&it[1], k, sizeof(k)) > 0) {
|
||||
if (strcmp(k, key) == 0) {
|
||||
if (spa_json_get_string(&it[1], value, len) <= 0)
|
||||
continue;
|
||||
|
@@ -80,7 +80,7 @@ wp_route_settings_api_convert (WpRouteSettingsApi * self,
|
||||
if (spa_json_enter_object(&it[0], &it[1]) <= 0)
|
||||
return NULL;
|
||||
|
||||
while (spa_json_get_string(&it[1], k, sizeof(k)-1) > 0) {
|
||||
while (spa_json_get_string(&it[1], k, sizeof(k)) > 0) {
|
||||
int len;
|
||||
const char *value;
|
||||
|
||||
@@ -98,9 +98,8 @@ wp_route_settings_api_convert (WpRouteSettingsApi * self,
|
||||
str = g_string_new("");
|
||||
while ((len = spa_json_next(&it[2], &value)) > 0) {
|
||||
char v[1024];
|
||||
if (len > 1023)
|
||||
if (spa_json_parse_stringn(value, len, v, sizeof(v)) < 0)
|
||||
continue;
|
||||
spa_json_parse_string(value, len, v);
|
||||
g_string_append_printf(str, "%s;", v);
|
||||
}
|
||||
return g_string_free(str, false);
|
||||
|
@@ -151,7 +151,7 @@ wp_init_transition_execute_step (WpTransition * transition, guint step)
|
||||
while (spa_json_enter_object(&it[1], &it[2]) > 0) {
|
||||
char *name = NULL, *type = NULL;
|
||||
|
||||
while (spa_json_get_string(&it[2], key, sizeof(key)-1) > 0) {
|
||||
while (spa_json_get_string(&it[2], key, sizeof(key)) > 0) {
|
||||
const char *val;
|
||||
int len;
|
||||
|
||||
@@ -160,10 +160,10 @@ wp_init_transition_execute_step (WpTransition * transition, guint step)
|
||||
|
||||
if (strcmp(key, "name") == 0) {
|
||||
name = (char*)val;
|
||||
spa_json_parse_string(val, len, name);
|
||||
spa_json_parse_stringn(val, len, name, len+1);
|
||||
} else if (strcmp(key, "type") == 0) {
|
||||
type = (char*)val;
|
||||
spa_json_parse_string(val, len, type);
|
||||
spa_json_parse_stringn(val, len, type, len+1);
|
||||
}
|
||||
}
|
||||
if (name == NULL || type == NULL) {
|
||||
|
Reference in New Issue
Block a user