uhttpd: fix crashes in the ubus plugin

[project/uhttpd.git] / ubus.c

diff --git a/ubus.c b/ubus.c
index 8129c20..da1ab60 100644 (file)
--- a/ubus.c
+++ b/ubus.c
@@ -241,7 +241,7 @@ static void uh_ubus_single_error(struct client *cl, enum rpc_error type)
        ops->request_done(cl);
 }
 
-static void uh_ubus_send_request(struct client *cl, json_object *obj, struct blob_attr *args)
+static void uh_ubus_send_request(struct client *cl, json_object *obj, const char *sid, struct blob_attr *args)
 {
        struct dispatch *d = &cl->dispatch;
        struct dispatch_ubus *du = &d->ubus;
@@ -250,8 +250,13 @@ static void uh_ubus_send_request(struct client *cl, json_object *obj, struct blo
        int ret, rem;
 
        blob_buf_init(&req, 0);
-       blobmsg_for_each_attr(cur, args, rem)
+       blobmsg_for_each_attr(cur, args, rem) {
+               if (!strcmp(blobmsg_name(cur), "ubus_rpc_session"))
+                       return uh_ubus_json_error(cl, ERROR_PARAMS);
                blobmsg_add_blob(&req, cur);
+       }
+
+       blobmsg_add_string(&req, "ubus_rpc_session", sid);
 
        blob_buf_init(&du->buf, 0);
        memset(&du->req, 0, sizeof(du->req));
@@ -327,6 +332,8 @@ static void uh_ubus_send_list(struct client *cl, json_object *obj, struct blob_a
 
        blob_buf_init(data.buf, 0);
 
+       uh_client_ref(cl);
+
        if (!params || blob_id(params) != BLOBMSG_TYPE_ARRAY) {
                r = blobmsg_open_array(data.buf, "result");
                ubus_lookup(ctx, NULL, uh_ubus_list_cb, &data);
@@ -346,6 +353,8 @@ static void uh_ubus_send_list(struct client *cl, json_object *obj, struct blob_a
                blobmsg_close_table(data.buf, r);
        }
 
+       uh_client_unref(cl);
+
        uh_ubus_init_response(cl);
        blobmsg_add_blob(&buf, blob_data(data.buf->head));
        uh_ubus_send_response(cl);
@@ -443,7 +452,7 @@ static bool uh_ubus_allowed(const char *sid, const char *obj, const char *fun)
                return false;
 
        blob_buf_init(&req, 0);
-       blobmsg_add_string(&req, "sid", sid);
+       blobmsg_add_string(&req, "ubus_rpc_session", sid);
        blobmsg_add_string(&req, "object", obj);
        blobmsg_add_string(&req, "function", fun);
 
@@ -458,6 +467,8 @@ static void uh_ubus_handle_request_object(struct client *cl, struct json_object
        struct rpc_data data = {};
        enum rpc_error err = ERROR_PARSE;
 
+       uh_client_ref(cl);
+
        if (json_object_get_type(obj) != json_type_object)
                goto error;
 
@@ -484,7 +495,7 @@ static void uh_ubus_handle_request_object(struct client *cl, struct json_object
                        goto error;
                }
 
-               uh_ubus_send_request(cl, obj, data.data);
+               uh_ubus_send_request(cl, obj, data.sid, data.data);
                goto out;
        }
        else if (!strcmp(data.method, "list")) {
@@ -501,6 +512,8 @@ error:
 out:
        if (data.params)
                free(data.params);
+
+       uh_client_unref(cl);
 }
 
 static void __uh_ubus_next_batched_request(struct uloop_timeout *timeout)