session: Fix crash when the UCI option 'password' or 'username' is missing

[project/rpcd.git] / uci.c

diff --git a/uci.c b/uci.c
index e23c95657a22396ef2921a68f01b6677b07a2d4c..3cd2b829efd055e3096da1499fbf2e70f5f1850b 100644 (file)
--- a/uci.c
+++ b/uci.c
@@ -734,6 +734,7 @@ rpc_uci_add(struct ubus_context *ctx, struct ubus_object *obj,
        {
                blobmsg_for_each_attr(cur, tb[RPC_A_VALUES], rem)
                {
+                       ptr.flags = 0;
                        ptr.o = NULL;
                        ptr.option = blobmsg_name(cur);
 
@@ -817,6 +818,7 @@ rpc_uci_merge_set(struct blob_attr *opt, struct uci_ptr *ptr)
        struct blob_attr *cur;
        int rem, rv;
 
+       ptr->flags = 0;
        ptr->o = NULL;
        ptr->option = blobmsg_name(opt);
        ptr->value = NULL;
@@ -829,8 +831,10 @@ rpc_uci_merge_set(struct blob_attr *opt, struct uci_ptr *ptr)
 
        if (blobmsg_type(opt) == BLOBMSG_TYPE_ARRAY)
        {
-               if (ptr->o)
+               if (ptr->o) {
                        uci_delete(cursor, ptr);
+                       ptr->flags = 0;
+               }
 
                rv = UBUS_STATUS_INVALID_ARGUMENT;
 
@@ -848,6 +852,7 @@ rpc_uci_merge_set(struct blob_attr *opt, struct uci_ptr *ptr)
        else if (ptr->o && ptr->o->type == UCI_TYPE_LIST)
        {
                uci_delete(cursor, ptr);
+               ptr->flags = 0;
 
                if (!rpc_uci_format_blob(opt, &ptr->value))
                        return UBUS_STATUS_INVALID_ARGUMENT;
@@ -979,6 +984,7 @@ rpc_uci_merge_delete(struct blob_attr *opt, struct uci_ptr *ptr)
                                continue;
 
                        uci_delete(cursor, ptr);
+                       ptr->flags = 0;
                        rv = 0;
                }
 
@@ -1131,7 +1137,7 @@ rpc_uci_order(struct ubus_context *ctx, struct ubus_object *obj,
        struct blob_attr *cur;
        struct uci_package *p = NULL;
        struct uci_ptr ptr = { 0 };
-       int rem, i = 0;
+       int rem, i = 0, err = 0;
 
        blobmsg_parse(rpc_uci_order_policy, __RPC_O_MAX, tb,
                      blob_data(msg), blob_len(msg));
@@ -1150,21 +1156,33 @@ rpc_uci_order(struct ubus_context *ctx, struct ubus_object *obj,
        blobmsg_for_each_attr(cur, tb[RPC_O_SECTIONS], rem)
        {
                if (blobmsg_type(cur) != BLOBMSG_TYPE_STRING)
+               {
+                       if (!err)
+                               err = UBUS_STATUS_INVALID_ARGUMENT;
+
                        continue;
+               }
 
                ptr.s = NULL;
                ptr.section = blobmsg_data(cur);
 
                if (uci_lookup_ptr(cursor, &ptr, NULL, true) || !ptr.s)
+               {
+                       if (!err)
+                               err = UBUS_STATUS_NOT_FOUND;
+
                        continue;
+               }
 
                uci_reorder_section(cursor, ptr.s, i++);
        }
 
-       uci_save(cursor, p);
+       if (!err)
+               uci_save(cursor, p);
+
        uci_unload(cursor, p);
 
-       return rpc_uci_status();
+       return err ? err : rpc_uci_status();
 }
 
 static void
@@ -1273,6 +1291,8 @@ rpc_uci_changes(struct ubus_context *ctx, struct ubus_object *obj,
                uci_unload(cursor, p);
        }
 
+       free(configs);
+
        blobmsg_close_table(&buf, c);
 
        ubus_send_reply(ctx, req, buf.head);
@@ -1377,6 +1397,8 @@ rpc_uci_configs(struct ubus_context *ctx, struct ubus_object *obj,
        for (i = 0; configs[i]; i++)
                blobmsg_add_string(&buf, NULL, configs[i]);
 
+       free(configs);
+
        blobmsg_close_array(&buf, c);
 
        ubus_send_reply(ctx, req, buf.head);
@@ -1756,7 +1778,7 @@ int rpc_uci_api_init(struct ubus_context *ctx)
        };
 
        static struct ubus_object_type uci_type =
-               UBUS_OBJECT_TYPE("luci-rpc-uci", uci_methods);
+               UBUS_OBJECT_TYPE("rpcd-plugin-uci", uci_methods);
 
        static struct ubus_object obj = {
                .name = "uci",