• source navigation  • diff markup  • identifier search  • freetext search  • 

Sources/ucode/tests/custom/99_bugs/54_json_read_method_use_after_free

  1 Test that `json()` survives the user's `read()` callback reassigning
  2 `obj.read` between calls. `uc_json_from_object()` caches the read method
  3 as a borrowed pointer for the parse loop; under the bug, reassignment
  4 drops the original closure's last owning reference and the next
  5 iteration dereferences freed memory.
  6 
  7 -- Testcase --
  8 {%
  9         let chunks = [ '{"hello": ', '"world"}' ];
 10         let idx = 0;
 11 
 12         let obj = {};
 13         obj.read = function(n) {
 14                 // state-machine pattern: first call swaps in the "real" reader
 15                 if (idx == 0) {
 16                         obj.read = function(n) {
 17                                 return idx < length(chunks) ? chunks[idx++] : "";
 18                         };
 19                 }
 20                 return idx < length(chunks) ? chunks[idx++] : "";
 21         };
 22 
 23         printf("%.J\n", json(obj));
 24 %}
 25 -- End --
 26 
 27 -- Expect stdout --
 28 {
 29         "hello": "world"
 30 }
 31 -- End --

This page was automatically generated by LXR 0.3.1.  •  OpenWrt