From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Thu, 11 Jan 2024 19:44:48 +0000 (+0900)
Subject: json: add trailing NUL byte in json_dispatch_byte_array_iovec()
X-Git-Tag: v256-rc1~1184^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1f179b37f2de95ef4ecb61c1e566c7cd07f83afd;p=thirdparty%2Fsystemd.git

json: add trailing NUL byte in json_dispatch_byte_array_iovec()

For safety.

Addresses https://github.com/systemd/systemd/pull/30879#discussion_r1448518226.
---

diff --git a/src/shared/json.c b/src/shared/json.c
index 47cd78b3965..5bb447ba917 100644
--- a/src/shared/json.c
+++ b/src/shared/json.c
@@ -5007,7 +5007,7 @@ int json_dispatch_byte_array_iovec(const char *name, JsonVariant *variant, JsonD
 
         sz = json_variant_elements(variant);
 
-        buffer = new(uint8_t, sz);
+        buffer = new(uint8_t, sz + 1);
         if (!buffer)
                 return json_log(variant, flags, SYNTHETIC_ERRNO(ENOMEM), "Out of memory.");
 
@@ -5028,6 +5028,9 @@ int json_dispatch_byte_array_iovec(const char *name, JsonVariant *variant, JsonD
         }
         assert(k == sz);
 
+        /* Append a NUL byte for safety, like we do in memdup_suffix0() and others. */
+        buffer[sz] = 0;
+
         free_and_replace(iov->iov_base, buffer);
         iov->iov_len = sz;
         return 0;