commit 604c1f0

Fixed use-after-free in reply messages.

  1@@ -663,12 +663,12 @@ int mastoapi_get_handler(const xs_dict *req, const char *q_path,
  2 
  3     int status    = 404;
  4     xs_dict *args = xs_dict_get(req, "q_vars");
  5-    xs *cmd       = xs_replace(q_path, "/api/v1", "");
  6+    xs *cmd       = xs_replace(q_path, "/api", "");
  7 
  8     snac snac1 = {0};
  9     int logged_in = process_auth_token(&snac1, req);
 10 
 11-    if (strcmp(cmd, "/accounts/verify_credentials") == 0) {
 12+    if (strcmp(cmd, "/v1/accounts/verify_credentials") == 0) {
 13         if (logged_in) {
 14             xs *acct = xs_dict_new();
 15 
 16@@ -700,7 +700,7 @@ int mastoapi_get_handler(const xs_dict *req, const char *q_path,
 17         }
 18     }
 19     else
 20-    if (strcmp(cmd, "/accounts/relationships") == 0) {
 21+    if (strcmp(cmd, "/v1/accounts/relationships") == 0) {
 22         /* find if an account is followed, blocked, etc. */
 23         /* the account to get relationships about is in args "id[]" */
 24         /* dummy by now */
 25@@ -711,11 +711,11 @@ int mastoapi_get_handler(const xs_dict *req, const char *q_path,
 26         }
 27     }
 28     else
 29-    if (xs_startswith(cmd, "/accounts/")) {
 30+    if (xs_startswith(cmd, "/v1/accounts/")) {
 31         /* account-related information */
 32         xs *l = xs_split(cmd, "/");
 33-        const char *uid = xs_list_get(l, 2);
 34-        const char *opt = xs_list_get(l, 3);
 35+        const char *uid = xs_list_get(l, 3);
 36+        const char *opt = xs_list_get(l, 4);
 37 
 38         if (uid != NULL) {
 39             snac snac2;
 40@@ -778,7 +778,7 @@ int mastoapi_get_handler(const xs_dict *req, const char *q_path,
 41         }
 42     }
 43     else
 44-    if (strcmp(cmd, "/timelines/home") == 0) {
 45+    if (strcmp(cmd, "/v1/timelines/home") == 0) {
 46         /* the private timeline */
 47         if (logged_in) {
 48             const char *max_id   = xs_dict_get(args, "max_id");
 49@@ -860,7 +860,7 @@ int mastoapi_get_handler(const xs_dict *req, const char *q_path,
 50         }
 51     }
 52     else
 53-    if (strcmp(cmd, "/timelines/public") == 0) {
 54+    if (strcmp(cmd, "/v1/timelines/public") == 0) {
 55         /* the public timeline (public timelines for all users) */
 56         /* TBD */
 57         *body  = xs_dup("[]");
 58@@ -868,14 +868,14 @@ int mastoapi_get_handler(const xs_dict *req, const char *q_path,
 59         status = 200;
 60     }
 61     else
 62-    if (strcmp(cmd, "/conversations") == 0) {
 63+    if (strcmp(cmd, "/v1/conversations") == 0) {
 64         /* TBD */
 65         *body  = xs_dup("[]");
 66         *ctype = "application/json";
 67         status = 200;
 68     }
 69     else
 70-    if (strcmp(cmd, "/notifications") == 0) {
 71+    if (strcmp(cmd, "/v1/notifications") == 0) {
 72         if (logged_in) {
 73             xs *l      = notify_list(&snac1, 0);
 74             xs *out    = xs_list_new();
 75@@ -945,63 +945,63 @@ int mastoapi_get_handler(const xs_dict *req, const char *q_path,
 76             status = 401;
 77     }
 78     else
 79-    if (strcmp(cmd, "/filters") == 0) {
 80+    if (strcmp(cmd, "/v1/filters") == 0) {
 81         /* snac will never have filters */
 82         *body  = xs_dup("[]");
 83         *ctype = "application/json";
 84         status = 200;
 85     }
 86     else
 87-    if (strcmp(cmd, "/favourites") == 0) {
 88+    if (strcmp(cmd, "/v1/favourites") == 0) {
 89         /* snac will never support a list of favourites */
 90         *body  = xs_dup("[]");
 91         *ctype = "application/json";
 92         status = 200;
 93     }
 94     else
 95-    if (strcmp(cmd, "/bookmarks") == 0) {
 96+    if (strcmp(cmd, "/v1/bookmarks") == 0) {
 97         /* snac does not support bookmarks */
 98         *body  = xs_dup("[]");
 99         *ctype = "application/json";
100         status = 200;
101     }
102     else
103-    if (strcmp(cmd, "/lists") == 0) {
104+    if (strcmp(cmd, "/v1/lists") == 0) {
105         /* snac does not support lists */
106         *body  = xs_dup("[]");
107         *ctype = "application/json";
108         status = 200;
109     }
110     else
111-    if (strcmp(cmd, "/scheduled_statuses") == 0) {
112+    if (strcmp(cmd, "/v1/scheduled_statuses") == 0) {
113         /* snac does not scheduled notes */
114         *body  = xs_dup("[]");
115         *ctype = "application/json";
116         status = 200;
117     }
118     else
119-    if (strcmp(cmd, "/follow_requests") == 0) {
120+    if (strcmp(cmd, "/v1/follow_requests") == 0) {
121         /* snac does not support optional follow confirmations */
122         *body  = xs_dup("[]");
123         *ctype = "application/json";
124         status = 200;
125     }
126     else
127-    if (strcmp(cmd, "/announcements") == 0) {
128+    if (strcmp(cmd, "/v1/announcements") == 0) {
129         /* snac has no announcements (yet?) */
130         *body  = xs_dup("[]");
131         *ctype = "application/json";
132         status = 200;
133     }
134     else
135-    if (strcmp(cmd, "/custom_emojis") == 0) {
136+    if (strcmp(cmd, "/v1/custom_emojis") == 0) {
137         /* are you kidding me? */
138         *body  = xs_dup("[]");
139         *ctype = "application/json";
140         status = 200;
141     }
142     else
143-    if (strcmp(cmd, "/instance") == 0) {
144+    if (strcmp(cmd, "/v1/instance") == 0) {
145         /* returns an instance object */
146         xs *ins = xs_dict_new();
147         const char *host = xs_dict_get(srv_config, "host");
148@@ -1036,11 +1036,11 @@ int mastoapi_get_handler(const xs_dict *req, const char *q_path,
149         status = 200;
150     }
151     else
152-    if (xs_startswith(cmd, "/statuses/")) {
153+    if (xs_startswith(cmd, "/v1/statuses/")) {
154         /* operations on a status */
155         xs *l = xs_split(cmd, "/");
156-        const char *id = xs_list_get(l, 2);
157-        const char *op = xs_list_get(l, 3);
158+        const char *id = xs_list_get(l, 3);
159+        const char *op = xs_list_get(l, 4);
160 
161         if (!xs_is_null(id)) {
162             xs *msg = NULL;
163@@ -1132,25 +1132,25 @@ int mastoapi_get_handler(const xs_dict *req, const char *q_path,
164         }
165     }
166     else
167-    if (strcmp(cmd, "/filters") == 0) {
168+    if (strcmp(cmd, "/v1/filters") == 0) {
169         *body  = xs_dup("[]");
170         *ctype = "application/json";
171         status = 200;
172     }
173     else
174-    if (strcmp(cmd, "/preferences") == 0) {
175+    if (strcmp(cmd, "/v1/preferences") == 0) {
176         *body  = xs_dup("{}");
177         *ctype = "application/json";
178         status = 200;
179     }
180     else
181-    if (strcmp(cmd, "/markers") == 0) {
182+    if (strcmp(cmd, "/v1/markers") == 0) {
183         *body  = xs_dup("{}");
184         *ctype = "application/json";
185         status = 200;
186     }
187     else
188-    if (strcmp(cmd, "/followed_tags") == 0) {
189+    if (strcmp(cmd, "/v1/followed_tags") == 0) {
190         *body  = xs_dup("[]");
191         *ctype = "application/json";
192         status = 200;
193@@ -1249,7 +1249,7 @@ int mastoapi_post_handler(const xs_dict *req, const char *q_path,
194             const char *summary    = xs_dict_get(args, "spoiler_text");
195 
196             xs *attach_list = xs_list_new();
197-            char *irt = NULL;
198+            xs *irt         = NULL;
199 
200             /* is it a reply? */
201             if (mid != NULL) {
202@@ -1257,7 +1257,7 @@ int mastoapi_post_handler(const xs_dict *req, const char *q_path,
203                 const char *md5 = MID_TO_MD5(mid);
204 
205                 if (valid_status(object_get_by_md5(md5, &r_msg)))
206-                    irt = xs_dict_get(r_msg, "id");
207+                    irt = xs_dup(xs_dict_get(r_msg, "id"));
208             }
209 
210             /* prepare the message */
211@@ -1294,8 +1294,8 @@ int mastoapi_post_handler(const xs_dict *req, const char *q_path,
212         if (logged_in) {
213             /* operations on a status */
214             xs *l = xs_split(cmd, "/");
215-            const char *mid = xs_list_get(l, 2);
216-            const char *op  = xs_list_get(l, 3);
217+            const char *mid = xs_list_get(l, 3);
218+            const char *op  = xs_list_get(l, 4);
219 
220             if (!xs_is_null(mid)) {
221                 xs *msg = NULL;