lua: avoid truncation of large numeric values

[oweals/ubus.git] / ubusd_proto.c

diff --git a/ubusd_proto.c b/ubusd_proto.c
index 2d04b5a7da6e83e73580a39ed9043b1e9dfe79ed..4746605f4960a45145741919edb49535f032dfe8 100644 (file)
--- a/ubusd_proto.c
+++ b/ubusd_proto.c
@@ -34,9 +34,9 @@ static const struct blob_attr_info ubus_policy[UBUS_ATTR_MAX] = {
        [UBUS_ATTR_GROUP] = { .type = BLOB_ATTR_STRING },
 };
 
-struct blob_attr **ubus_parse_msg(struct blob_attr *msg)
+struct blob_attr **ubus_parse_msg(struct blob_attr *msg, size_t len)
 {
-       blob_parse(msg, attrbuf, ubus_policy, UBUS_ATTR_MAX);
+       blob_parse_untrusted(msg, len, attrbuf, ubus_policy, UBUS_ATTR_MAX);
        return attrbuf;
 }
 
@@ -454,7 +454,7 @@ void ubusd_proto_receive_message(struct ubus_client *cl, struct ubus_msg_buf *ub
        /* Note: no callback should free the `ub` buffer
                 that's always done right after the callback finishes */
        if (cb)
-               ret = cb(cl, ub, ubus_parse_msg(ub->data));
+               ret = cb(cl, ub, ubus_parse_msg(ub->data, blob_raw_len(ub->data)));
        else
                ret = UBUS_STATUS_INVALID_COMMAND;
 
@@ -519,12 +519,12 @@ free:
 
 void ubusd_proto_free_client(struct ubus_client *cl)
 {
-       struct ubus_object *obj;
+       struct ubus_object *obj, *tmp;
 
-       while (!list_empty(&cl->objects)) {
-               obj = list_first_entry(&cl->objects, struct ubus_object, list);
+       list_for_each_entry_safe(obj, tmp, &cl->objects, list) {
                ubusd_free_object(obj);
        }
+
        ubus_msg_free(cl->retmsg);
        blob_buf_free(&cl->b);