parser json BUGFIX use-after-free of escaped member names

A member name containing escape sequences is decoded into a buffer
owned by the JSON context, which is freed by the next
lyjson_ctx_next(). lydjson_meta_attr_instance() and lydjson_envelope()
kept using the name/prefix pointing into it after that call, so take
ownership of the buffer the same way lydjson_subtree_r() does.

Author: affan-arch

src/parser_json.c

@@ -754,6 +754,7 @@ lydjson_meta_attr_instance(struct lyd_json_ctx *lydctx, struct lyd_node *node, c
     LY_ERR rc = LY_SUCCESS;
     enum LYJSON_PARSER_STATUS status;
     const char *name, *prefix;
+    char *value = NULL;
     uint32_t name_len, prefix_len;
     struct lys_module *mod;
     const struct ly_ctx *ctx = lydctx->jsonctx->ctx;
@@ -773,6 +774,7 @@ lydjson_meta_attr_instance(struct lyd_json_ctx *lydctx, struct lyd_node *node, c
         }
 
         lydjson_parse_name(lydctx->jsonctx->value, lydctx->jsonctx->value_len, &name, &name_len, &prefix, &prefix_len, &is_attr);
+        lyjson_ctx_give_dynamic_value(lydctx->jsonctx, &value);
 
         if (!name_len) {
             LOGVAL(ctx, prev_node, LYVE_SYNTAX_JSON, "Metadata in JSON found with an empty name, followed by \"%.10s\".", name);
@@ -851,6 +853,7 @@ lydjson_meta_attr_instance(struct lyd_json_ctx *lydctx, struct lyd_node *node, c
     }
 
 cleanup:
+    free(value);
     return rc;
 }
 
@@ -2109,6 +2112,7 @@ lydjson_envelope(struct lyjson_ctx *jsonctx, const char *name, const char *modul
     LY_ERR rc = LY_SUCCESS, r;
     enum LYJSON_PARSER_STATUS status = lyjson_ctx_status(jsonctx);
     const char *nam, *prefix;
+    char *value = NULL;
     uint32_t nam_len, prefix_len;
     ly_bool is_meta;
 
@@ -2127,6 +2131,7 @@ lydjson_envelope(struct lyjson_ctx *jsonctx, const char *name, const char *modul
     /* process the name */
     assert(status == LYJSON_OBJECT_NAME);
     lydjson_parse_name(jsonctx->value, jsonctx->value_len, &nam, &nam_len, &prefix, &prefix_len, &is_meta);
+    lyjson_ctx_give_dynamic_value(jsonctx, &value);
     if (is_meta) {
         LOGVAL(jsonctx->ctx, NULL, LYVE_DATA, "Unexpected metadata.");
         rc = LY_EVALID;
@@ -2151,6 +2156,7 @@ lydjson_envelope(struct lyjson_ctx *jsonctx, const char *name, const char *modul
     LY_CHECK_GOTO(rc, cleanup);
 
 cleanup:
+    free(value);
     if (rc) {
         lyd_free_tree(*envp);
         *envp = NULL;

tests/utests/data/test_parser_json.c

@@ -220,6 +220,12 @@ test_leaf(void **state)
     assert_int_equal(LY_EINVAL, lyd_parse_data_mem(UTEST_LYCTX, data, LYD_JSON, 0, LYD_VALIDATE_PRESENT, &tree));
     CHECK_LOG_CTX("Annotation definition for attribute \"a:hi\nt\" not found.", "/a:foo/@a:hi\nt", 1);
 
+    /* escaped metadata member name */
+    data = "{\"a:foo\":\"xxx\",\"@a:foo\":{\"a:hin\\u0074\":1}}";
+    CHECK_PARSE_LYD(data, 0, LYD_VALIDATE_PRESENT, tree);
+    CHECK_LYD_META(tree->meta, 1, "hint", 0, 1,  INT8, "1", 1);
+    lyd_free_all(tree);
+
     data = "{\"a:foo\": null}";
     PARSER_CHECK_ERROR(data, 0, LYD_VALIDATE_PRESENT, tree, LY_EVALID, "Invalid non-string-encoded string value \"\".", "/a:foo", 1);
     CHECK_PARSE_LYD(data, LYD_PARSE_JSON_NULL, LYD_VALIDATE_PRESENT, tree);
@@ -990,6 +996,19 @@ test_restconf_notification(void **state)
     lyd_free_all(tree);
     lyd_free_all(ntf);
 
+    /* escaped envelope member name */
+    data = "{\"ietf-restconf:notificatio\\u006e\":{\"eventTime\":\"2013-12-21T00:01:00Z\",\"a:n2\":{}}}";
+    assert_int_equal(LY_SUCCESS, ly_in_new_memory(data, &in));
+    assert_int_equal(LY_SUCCESS, lyd_parse_op(UTEST_LYCTX, NULL, in, LYD_JSON, LYD_TYPE_NOTIF_RESTCONF, LYD_PARSE_STRICT,
+            &tree, &ntf));
+    ly_in_free(in, 0);
+
+    data = "{\"ietf-restconf:notification\":{\"eventTime\":\"2013-12-21T00:01:00Z\"}}";
+    CHECK_LYD_STRING(tree, LYD_PRINT_SHRINK | LYD_PRINT_SIBLINGS, data);
+
+    lyd_free_all(tree);
+    lyd_free_all(ntf);
+
     /* wrong order */
     data = "{\"ietf-restconf:notification\":{\"a:n2\":{},\"eventTime\":\"2013-12-21T00:01:00Z\"}}";
     assert_int_equal(LY_SUCCESS, ly_in_new_memory(data, &in));