From a19c7f3d2fe7c5f1d780e64af3efebee8670ae65 Mon Sep 17 00:00:00 2001
From: Julian Bouzas <julian.bouzas@collabora.com>
Date: Tue, 21 Jun 2022 11:52:53 -0400
Subject: [PATCH] spa-json: only add the json data represented by its size

The data pointer of a WpSpaJson object can be bigger than the actual WpSpaJson
size. For example, this happens when iterating an array: instead of
re-allocating the nested data into a new region of memory, the iterator uses
the same region of memory as the parent, and just sets the pointer data and size
to the correct location when creating the nested WpSpaJson object.

This patch makes sure only the data represented by the size is added into the
builder when adding a json object, fixing issues that were happening before when
adding nested objects directly from a second WpSpaJson object.
---
 lib/wp/spa-json.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/wp/spa-json.c b/lib/wp/spa-json.c
index 193d1051..45eccedb 100644
--- a/lib/wp/spa-json.c
+++ b/lib/wp/spa-json.c
@@ -953,6 +953,14 @@ builder_add_formatted (WpSpaJsonBuilder *self, const gchar *fmt, ...)
   self->size += s;
 }
 
+static void
+builder_add_json (WpSpaJsonBuilder *self, WpSpaJson *json)
+{
+  g_return_if_fail (self->max_size - self->size >= json->size + 1);
+  snprintf (self->data + self->size, json->size + 1, "%s", json->data);
+  self->size += json->size;
+}
+
 /*!
  * \brief Adds a property into the builder
  *
@@ -1053,14 +1061,14 @@ wp_spa_json_builder_add_string (WpSpaJsonBuilder *self, const gchar *value)
  *
  * \ingroup wpspajson
  * \param self the spa json builder object
- * \param json the json value
+ * \param json (transfer none): the json value
  */
 void
 wp_spa_json_builder_add_json (WpSpaJsonBuilder *self, WpSpaJson *json)
 {
   ensure_separator (self, FALSE);
   ensure_allocated_max_size (self, json->size);
-  builder_add_formatted (self, "%s", json->data);
+  builder_add_json (self, json);
 }
 
 /*!