github-mirrors/thirdparty-ArduinoJson
1
0
Fork 0
mirror of https://github.com/eledio-devices/thirdparty-ArduinoJson.git synced 2025-10-31 16:14:11 +01:00
Code Issues Packages Projects Releases Wiki Activity

Restored JsonVariantLocal to fix the use-after-free

Browse Source
This commit is contained in:
Benoit Blanchon
2018-10-12 21:00:00 +02:00
parent 02d809f3f4
commit 8230f8fc9b
2 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/ArduinoJson/JsonVariant.hpp
View File

@@ -321,4 +321,15 @@ class JsonVariantConst : public JsonVariantProxy<const JsonVariantData>,
return JsonVariantConst(objectGet(variantAsObject(_data), makeString(key)));
}
};
class JsonVariantLocal : public JsonVariant {
public:
explicit JsonVariantLocal(MemoryPool *memoryPool)
: JsonVariant(memoryPool, &_localData) {
_localData.type = JSON_NULL;
}
private:
JsonVariantData _localData;
};
} // namespace ARDUINOJSON_NAMESPACE

3
src/ArduinoJson/MsgPack/MsgPackDeserializer.hpp
View File

@@ -278,8 +278,7 @@ class MsgPackDeserializer {
if (_nestingLimit == 0) return DeserializationError::TooDeep;
--_nestingLimit;
for (; n; --n) {
JsonVariantData keyData;
JsonVariant key(_memoryPool, &keyData);
JsonVariantLocal key(_memoryPool);
DeserializationError err = parse(key);
if (err) return err;
if (!key.is<char *>()) return DeserializationError::NotSupported;