mirror of
https://github.com/json-c/json-c.git
synced 2026-11-09 23:40:14 +08:00
json_patch: treat an empty "from" as a parent of any "path"
Since the token-boundary check for the parent/child test (1b504e2), an
empty "from" (the root) only counts as a prefix of "path" when "path"
starts with '/'. With an invalid "path" like "a", a move from "" went
on to remove the root: __json_patch_apply_remove() dropped a reference
to the document, the following set failed on the bad path, and the
error path dropped the last reference, so *base was freed while the
caller still owned it (use-after-free / double free in
json_object_put()).
The root is a parent of every other location, so an empty "from" now
always takes the parent/child branch: a no-op for "path": "" and
EINVAL otherwise. This also restores the invariant the comment below
relies on, that json_pointer can't find the root here.
Added move and copy cases to json_patch_tests.json and regenerated
test_json_patch.expected.
This commit is contained in:
1 parent
ea3756e561
commit
cdd8db0530
3 files changed
+15
-1
No files matched your search
+1
-1
@@ -292,7 +292,7 @@ static int json_patch_apply_move_copy(struct json_object **res,
|
||||
* sibling keys that happen to share a name prefix.
|
||||
*/
|
||||
if (strncmp(from_s, path, from_s_len) == 0 &&
|
||||
(path[from_s_len] == '\0' || path[from_s_len] == '/')) {
|
||||
(from_s_len == 0 || path[from_s_len] == '\0' || path[from_s_len] == '/')) {
|
||||
/**
|
||||
* If lengths match, it's a noop, if they don't,
|
||||
* then we're trying to move a parent under a child
|
||||
|
||||
Reference in new issue
Block a user