From: Rafał Miłecki <ra...@milecki.pl>
Initializing buffer in the uh_ubus_handle_request() didn't handle
batched requests correctly. It resulted in reusing buffer and generating
malformed replies.
Call blob_buf_init() before every usage of the global buf variable.
While at it make two functions take blob_buf pointer as argument:
1. uh_ubus_send_response()
2. uh_ubus_init_json_rpc_response()
This helps following global "buf" variable usage and will help avoiding
similar bugs in the future.
Fixes: 628341fae412 ("ubus: use local "blob_buf" in
uh_ubus_handle_request_object()")
Signed-off-by: Rafał Miłecki <ra...@milecki.pl>
---
ubus.c | 31 +++++++++++++++++--------------
1 file changed, 17 insertions(+), 14 deletions(-)
diff --git a/ubus.c b/ubus.c
index c22e07a..a458f4c 100644
--- a/ubus.c
+++ b/ubus.c
@@ -169,7 +169,7 @@ static void uh_ubus_send_header(struct client *cl)
ustream_printf(cl->us, "\r\n");
}
-static void uh_ubus_send_response(struct client *cl)
+static void uh_ubus_send_response(struct client *cl, struct blob_buf *buf)
{
struct dispatch_ubus *du = &cl->dispatch.ubus;
const char *sep = "";
@@ -178,7 +178,7 @@ static void uh_ubus_send_response(struct client *cl)
if (du->array && du->array_idx > 1)
sep = ",";
- str = blobmsg_format_json(buf.head, true);
+ str = blobmsg_format_json(buf->head, true);
ops->chunk_printf(cl, "%s%s", sep, str);
free(str);
@@ -189,32 +189,34 @@ static void uh_ubus_send_response(struct client *cl)
return ops->request_done(cl);
}
-static void uh_ubus_init_json_rpc_response(struct client *cl)
+static void uh_ubus_init_json_rpc_response(struct client *cl, struct blob_buf
*buf)
{
struct dispatch_ubus *du = &cl->dispatch.ubus;
struct json_object *obj = du->jsobj_cur, *obj2 = NULL;
- blobmsg_add_string(&buf, "jsonrpc", "2.0");
+ blobmsg_add_string(buf, "jsonrpc", "2.0");
if (obj)
json_object_object_get_ex(obj, "id", &obj2);
if (obj2)
- blobmsg_add_json_element(&buf, "id", obj2);
+ blobmsg_add_json_element(buf, "id", obj2);
else
- blobmsg_add_field(&buf, BLOBMSG_TYPE_UNSPEC, "id", NULL, 0);
+ blobmsg_add_field(buf, BLOBMSG_TYPE_UNSPEC, "id", NULL, 0);
}
static void uh_ubus_json_rpc_error(struct client *cl, enum rpc_error type)
{
void *c;
- uh_ubus_init_json_rpc_response(cl);
+ blob_buf_init(&buf, 0);
+
+ uh_ubus_init_json_rpc_response(cl, &buf);
c = blobmsg_open_table(&buf, "error");
blobmsg_add_u32(&buf, "code", json_errors[type].code);
blobmsg_add_string(&buf, "message", json_errors[type].msg);
blobmsg_close_table(&buf, c);
- uh_ubus_send_response(cl);
+ uh_ubus_send_response(cl, &buf);
}
static void
@@ -234,14 +236,16 @@ uh_ubus_request_cb(struct ubus_request *req, int ret)
void *r;
int rem;
+ blob_buf_init(&buf, 0);
+
uloop_timeout_cancel(&du->timeout);
- uh_ubus_init_json_rpc_response(cl);
+ uh_ubus_init_json_rpc_response(cl, &buf);
r = blobmsg_open_array(&buf, "result");
blobmsg_add_u32(&buf, "", ret);
blob_for_each_attr(cur, du->buf.head, rem)
blobmsg_add_blob(&buf, cur);
blobmsg_close_array(&buf, r);
- uh_ubus_send_response(cl);
+ uh_ubus_send_response(cl, &buf);
}
static void
@@ -401,9 +405,10 @@ static void uh_ubus_send_list(struct client *cl, struct
blob_attr *params)
uh_client_unref(cl);
- uh_ubus_init_json_rpc_response(cl);
+ blob_buf_init(&buf, 0);
+ uh_ubus_init_json_rpc_response(cl, &buf);
blobmsg_add_blob(&buf, blob_data(data.buf->head));
- uh_ubus_send_response(cl);
+ uh_ubus_send_response(cl, &buf);
}
static bool parse_json_rpc(struct rpc_data *d, struct blob_attr *data)
@@ -627,8 +632,6 @@ static void uh_ubus_handle_request(struct client *cl, char
*url, struct path_inf
{
struct dispatch *d = &cl->dispatch;
- blob_buf_init(&buf, 0);
-
switch (cl->request.method)
{
case UH_HTTP_MSG_POST:
--
2.27.0
_______________________________________________
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
