json_patch: treat an empty "from" as a parent of any "path"

Since the token-boundary check for the parent/child test (1b504e2), an
empty "from" (the root) only counts as a prefix of "path" when "path"
starts with '/'. With an invalid "path" like "a", a move from "" went
on to remove the root: __json_patch_apply_remove() dropped a reference
to the document, the following set failed on the bad path, and the
error path dropped the last reference, so *base was freed while the
caller still owned it (use-after-free / double free in
json_object_put()).

The root is a parent of every other location, so an empty "from" now
always takes the parent/child branch: a no-op for "path": "" and
EINVAL otherwise. This also restores the invariant the comment below
relies on, that json_pointer can't find the root here.

Added move and copy cases to json_patch_tests.json and regenerated
test_json_patch.expected.
This commit is contained in:
EminY authored and Eric Hawicz committed 2026-11-08 21:27:08 -05:00
1 parent ea3756e561
commit cdd8db0530
3 files changed
+15 -1

No files matched your search

+1 -1
View File
@@ -292,7 +292,7 @@ static int json_patch_apply_move_copy(struct json_object **res,
* sibling keys that happen to share a name prefix.
*/
if (strncmp(from_s, path, from_s_len) == 0 &&
(path[from_s_len] == '\0' || path[from_s_len] == '/')) {
(from_s_len == 0 || path[from_s_len] == '\0' || path[from_s_len] == '/')) {
/**
* If lengths match, it's a noop, if they don't,
* then we're trying to move a parent under a child