json: avoid stack allocation of long strings in a recursive function

Fixes: oss-fuzz#10908
https://oss-fuzz.com/v2/testcase-detail/5639441482252288

diff --git a/src/basic/json.c b/src/basic/json.c
index 0a2a620c3bf300e9c07cd3003fe90040c89b194d..ec2952c6da3b3aa277fe8105da943bfba01875a6 100644 (file)
--- a/src/basic/json.c
+++ b/src/basic/json.c
@@ -1344,10 +1344,15 @@ static int json_format(FILE *f, JsonVariant *v, unsigned flags, const char *pref
                 if (n == 0)
                         fputs("[]", f);
                 else {
+                        _cleanup_free_ char *joined = NULL;
                         const char *prefix2;
 
                         if (flags & JSON_FORMAT_PRETTY) {
-                                prefix2 = strjoina(strempty(prefix), "\t");
+                                joined = strjoin(strempty(prefix), "\t");
+                                if (!joined)
+                                        return -ENOMEM;
+
+                                prefix2 = joined;
                                 fputs("[\n", f);
                         } else {
                                 prefix2 = strempty(prefix);
@@ -1395,10 +1400,15 @@ static int json_format(FILE *f, JsonVariant *v, unsigned flags, const char *pref
                 if (n == 0)
                         fputs("{}", f);
                 else {
+                        _cleanup_free_ char *joined = NULL;
                         const char *prefix2;
 
                         if (flags & JSON_FORMAT_PRETTY) {
-                                prefix2 = strjoina(strempty(prefix), "\t");
+                                joined = strjoin(strempty(prefix), "\t");
+                                if (!joined)
+                                        return -ENOMEM;
+
+                                prefix2 = joined;
                                 fputs("{\n", f);
                         } else {
                                 prefix2 = strempty(prefix);