Initializing buffer in the uh_ubus_handle_request() didn't handle
batched requests correctly. It resulted in reusing buffer and generating
malformed replies.
Call blob_buf_init() before every usage of the global buf variable.
While at it make two functions take blob_buf pointer as argument:
1. uh_ubus_send_response()
2. uh_ubus_init_json_rpc_response()
This helps following global "buf" variable usage and will help avoiding
similar bugs in the future.
Fixes: 628341fae412 ("ubus: use local "blob_buf" in uh_ubus_handle_request_object()")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
ustream_printf(cl->us, "\r\n");
}
ustream_printf(cl->us, "\r\n");
}
-static void uh_ubus_send_response(struct client *cl)
+static void uh_ubus_send_response(struct client *cl, struct blob_buf *buf)
{
struct dispatch_ubus *du = &cl->dispatch.ubus;
const char *sep = "";
{
struct dispatch_ubus *du = &cl->dispatch.ubus;
const char *sep = "";
if (du->array && du->array_idx > 1)
sep = ",";
if (du->array && du->array_idx > 1)
sep = ",";
- str = blobmsg_format_json(buf.head, true);
+ str = blobmsg_format_json(buf->head, true);
ops->chunk_printf(cl, "%s%s", sep, str);
free(str);
ops->chunk_printf(cl, "%s%s", sep, str);
free(str);
return ops->request_done(cl);
}
return ops->request_done(cl);
}
-static void uh_ubus_init_json_rpc_response(struct client *cl)
+static void uh_ubus_init_json_rpc_response(struct client *cl, struct blob_buf *buf)
{
struct dispatch_ubus *du = &cl->dispatch.ubus;
struct json_object *obj = du->jsobj_cur, *obj2 = NULL;
{
struct dispatch_ubus *du = &cl->dispatch.ubus;
struct json_object *obj = du->jsobj_cur, *obj2 = NULL;
- blobmsg_add_string(&buf, "jsonrpc", "2.0");
+ blobmsg_add_string(buf, "jsonrpc", "2.0");
if (obj)
json_object_object_get_ex(obj, "id", &obj2);
if (obj2)
if (obj)
json_object_object_get_ex(obj, "id", &obj2);
if (obj2)
- blobmsg_add_json_element(&buf, "id", obj2);
+ blobmsg_add_json_element(buf, "id", obj2);
- blobmsg_add_field(&buf, BLOBMSG_TYPE_UNSPEC, "id", NULL, 0);
+ blobmsg_add_field(buf, BLOBMSG_TYPE_UNSPEC, "id", NULL, 0);
}
static void uh_ubus_json_rpc_error(struct client *cl, enum rpc_error type)
{
void *c;
}
static void uh_ubus_json_rpc_error(struct client *cl, enum rpc_error type)
{
void *c;
- uh_ubus_init_json_rpc_response(cl);
+ blob_buf_init(&buf, 0);
+
+ uh_ubus_init_json_rpc_response(cl, &buf);
c = blobmsg_open_table(&buf, "error");
blobmsg_add_u32(&buf, "code", json_errors[type].code);
blobmsg_add_string(&buf, "message", json_errors[type].msg);
blobmsg_close_table(&buf, c);
c = blobmsg_open_table(&buf, "error");
blobmsg_add_u32(&buf, "code", json_errors[type].code);
blobmsg_add_string(&buf, "message", json_errors[type].msg);
blobmsg_close_table(&buf, c);
- uh_ubus_send_response(cl);
+ uh_ubus_send_response(cl, &buf);
+ blob_buf_init(&buf, 0);
+
uloop_timeout_cancel(&du->timeout);
uloop_timeout_cancel(&du->timeout);
- uh_ubus_init_json_rpc_response(cl);
+ uh_ubus_init_json_rpc_response(cl, &buf);
r = blobmsg_open_array(&buf, "result");
blobmsg_add_u32(&buf, "", ret);
blob_for_each_attr(cur, du->buf.head, rem)
blobmsg_add_blob(&buf, cur);
blobmsg_close_array(&buf, r);
r = blobmsg_open_array(&buf, "result");
blobmsg_add_u32(&buf, "", ret);
blob_for_each_attr(cur, du->buf.head, rem)
blobmsg_add_blob(&buf, cur);
blobmsg_close_array(&buf, r);
- uh_ubus_send_response(cl);
+ uh_ubus_send_response(cl, &buf);
- uh_ubus_init_json_rpc_response(cl);
+ blob_buf_init(&buf, 0);
+ uh_ubus_init_json_rpc_response(cl, &buf);
blobmsg_add_blob(&buf, blob_data(data.buf->head));
blobmsg_add_blob(&buf, blob_data(data.buf->head));
- uh_ubus_send_response(cl);
+ uh_ubus_send_response(cl, &buf);
}
static bool parse_json_rpc(struct rpc_data *d, struct blob_attr *data)
}
static bool parse_json_rpc(struct rpc_data *d, struct blob_attr *data)
{
struct dispatch *d = &cl->dispatch;
{
struct dispatch *d = &cl->dispatch;
- blob_buf_init(&buf, 0);
-
switch (cl->request.method)
{
case UH_HTTP_MSG_POST:
switch (cl->request.method)
{
case UH_HTTP_MSG_POST: