From beb09ecc11a75362113c1e8fcd8245ecce061a8f Mon Sep 17 00:00:00 2001 From: scottmk Date: Tue, 3 Feb 2009 17:53:48 +0000 Subject: [PATCH] Added a couple of sanity checks to SELECT(). Return NULL if (1) the input jsonObject for the join tree is neither a hash, nor an array, nor a string; or (2) it's a hash with more than one element. git-svn-id: svn://svn.open-ils.org/ILS/trunk@12046 dcc99617-32d9-48b4-a31d-7c20da2025e4 --- Open-ILS/src/c-apps/oils_cstore.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Open-ILS/src/c-apps/oils_cstore.c b/Open-ILS/src/c-apps/oils_cstore.c index 6f022a7da3..b8f37c7a6f 100644 --- a/Open-ILS/src/c-apps/oils_cstore.c +++ b/Open-ILS/src/c-apps/oils_cstore.c @@ -2353,9 +2353,15 @@ static char* SELECT ( core_class = strdup( tmp_itr->key ); join_hash = snode; + + jsonObject* extra = jsonIteratorNext( tmp_itr ); jsonIteratorFree( tmp_itr ); snode = NULL; + + // There shouldn't be more than one entry in join_hash + if( extra ) + return NULL; // Malformed join_hash; extra entry } else if (join_hash->type == JSON_ARRAY) { from_function = 1; @@ -2365,6 +2371,8 @@ static char* SELECT ( core_class = jsonObjectToSimpleString( join_hash ); join_hash = NULL; } + else + return NULL; // punt if we don't know about the core class (and it's not a function) if (!from_function && !(core_meta = osrfHashGet( oilsIDL(), core_class ))) { -- 2.11.0