feedc0de/ArduinoJson
1
0
Fork 0
forked from bblanchon/ArduinoJson
Code Pull Requests Activity

Restored JsonVariantLocal to fix the use-after-free

Browse Source
This commit is contained in:
Benoit Blanchon
2018-10-12 21:00:00 +02:00
parent 02d809f3f4
commit 8230f8fc9b
2 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/ArduinoJson/JsonVariant.hpp
View File

@ -321,4 +321,15 @@ class JsonVariantConst : public JsonVariantProxy<const JsonVariantData>,
return JsonVariantConst(objectGet(variantAsObject(_data), makeString(key))); return JsonVariantConst(objectGet(variantAsObject(_data), makeString(key)));
} }
}; };
class JsonVariantLocal : public JsonVariant {
public:
explicit JsonVariantLocal(MemoryPool *memoryPool)
: JsonVariant(memoryPool, &_localData) {
_localData.type = JSON_NULL;
}
private:
JsonVariantData _localData;
};
} // namespace ARDUINOJSON_NAMESPACE } // namespace ARDUINOJSON_NAMESPACE

3
src/ArduinoJson/MsgPack/MsgPackDeserializer.hpp
View File

@ -278,8 +278,7 @@ class MsgPackDeserializer {
if (_nestingLimit == 0) return DeserializationError::TooDeep; if (_nestingLimit == 0) return DeserializationError::TooDeep;
--_nestingLimit; --_nestingLimit;
for (; n; --n) { for (; n; --n) {
JsonVariantData keyData; JsonVariantLocal key(_memoryPool);
JsonVariant key(_memoryPool, &keyData);
DeserializationError err = parse(key); DeserializationError err = parse(key);
if (err) return err; if (err) return err;
if (!key.is<char *>()) return DeserializationError::NotSupported; if (!key.is<char *>()) return DeserializationError::NotSupported;