From cbb3092ce647221644204c4b79ae8088303bda82 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Tue, 8 Jan 2019 18:34:38 +0100
Subject: [PATCH] json: let's not accept embedded NUL bytes when allocating
 JSON strings

Let's add an additional paranoia check, and not accept embedded NUL
bytes in strings, just in case.
---
 src/shared/json.c | 8 ++++++--
 src/shared/json.h | 2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/shared/json.c b/src/shared/json.c
index 38113d792c..073f800b34 100644
--- a/src/shared/json.c
+++ b/src/shared/json.c
@@ -379,9 +379,13 @@ int json_variant_new_stringn(JsonVariant **ret, const char *s, size_t n) {
 
         assert_return(ret, -EINVAL);
         if (!s) {
-                assert_return(n == 0, -EINVAL);
+                assert_return(IN_SET(n, 0, (size_t) -1), -EINVAL);
                 return json_variant_new_null(ret);
         }
+        if (n == (size_t) -1) /* determine length automatically */
+                n = strlen(s);
+        else if (memchr(s, 0, n)) /* don't allow embedded NUL, as we can't express that in JSON */
+                return -EINVAL;
         if (n == 0) {
                 *ret = JSON_VARIANT_MAGIC_EMPTY_STRING;
                 return 0;
@@ -585,7 +589,7 @@ int json_variant_new_array_strv(JsonVariant **ret, char **l) {
                 if (k > INLINE_STRING_MAX) {
                         /* If string is too long, store it as reference. */
 
-                        r = json_variant_new_stringn(&w->reference, l[v->n_elements], k);
+                        r = json_variant_new_string(&w->reference, l[v->n_elements]);
                         if (r < 0)
                                 return r;
 
diff --git a/src/shared/json.h b/src/shared/json.h
index 70dfe70dfd..057dc2633e 100644
--- a/src/shared/json.h
+++ b/src/shared/json.h
@@ -65,7 +65,7 @@ int json_variant_new_object(JsonVariant **ret, JsonVariant **array, size_t n);
 int json_variant_new_null(JsonVariant **ret);
 
 static inline int json_variant_new_string(JsonVariant **ret, const char *s) {
-        return json_variant_new_stringn(ret, s, strlen_ptr(s));
+        return json_variant_new_stringn(ret, s, (size_t) -1);
 }
 
 JsonVariant *json_variant_ref(JsonVariant *v);