From 373a791158519cc4c00d56afe7f98f7133655945 Mon Sep 17 00:00:00 2001
From: Jason Volk <jason@zemos.net>
Date: Sat, 17 Mar 2018 11:52:28 -0700
Subject: [PATCH] ircd::json: Limit IOV size and take stringify buffer
 off-stack.

---
 include/ircd/json/iov.h |  9 ++++++---
 ircd/json.cc            | 15 ++++++++++++++-
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/include/ircd/json/iov.h b/include/ircd/json/iov.h
index be5183e6c..2d0ccaf08 100644
--- a/include/ircd/json/iov.h
+++ b/include/ircd/json/iov.h
@@ -38,9 +38,6 @@ namespace ircd::json
 struct ircd::json::iov
 :ircd::iov<ircd::json::member>
 {
-	IRCD_EXCEPTION(json::error, error);
-	IRCD_EXCEPTION(error, exists);
-
 	struct push;
 	struct add;
 	struct add_if;
@@ -49,6 +46,12 @@ struct ircd::json::iov
 	struct defaults;
 	struct defaults_if;
 
+	IRCD_EXCEPTION(json::error, error);
+	IRCD_EXCEPTION(error, exists);
+	IRCD_EXCEPTION(error, oversize);
+
+	static const size_t MAX_SIZE;
+
   public:
 	bool has(const string_view &key) const;
 	const value &at(const string_view &key) const;
diff --git a/ircd/json.cc b/ircd/json.cc
index 704aa50ed..705ac56ed 100644
--- a/ircd/json.cc
+++ b/ircd/json.cc
@@ -368,6 +368,12 @@ ircd::json::input<it>::throws_exceeded()
 // iov.h
 //
 
+decltype(ircd::json::iov::MAX_SIZE)
+ircd::json::iov::MAX_SIZE
+{
+	1024
+};
+
 std::ostream &
 ircd::json::operator<<(std::ostream &s, const iov &iov)
 {
@@ -379,7 +385,14 @@ ircd::string_view
 ircd::json::stringify(mutable_buffer &buf,
                       const iov &iov)
 {
-	const member *m[iov.size()];
+	const ctx::critical_assertion ca;
+	thread_local const member *m[iov.MAX_SIZE];
+	if(unlikely(size_t(iov.size()) > iov.MAX_SIZE))
+		throw iov::oversize
+		{
+			"IOV has %zd members but maximum is %zu", iov.size(), iov.MAX_SIZE
+		};
+
 	std::transform(std::begin(iov), std::end(iov), m, []
 	(const member &m)
 	{