server: pass the escaped buffer, not escape_json()'s length, to %s

[Jamp]

Since 1e92d52 ("Sharing JSON escaping…"), escape_json() returns the number of bytes
written (int), but the /api/rtsp and /api/onvif handlers still pass its return
value straight to sprintf's %s. sprintf then dereferences that small integer as a
pointer, and any authenticated GET /api/rtsp or GET /api/onvif kills divinus with
SIGSEGV (Error occured (11)! Quitting...). The web UI requests /api/onvif when it
loads, so simply opening it takes the stream down.

The fix escapes into the existing buffers first and passes the buffers (3 call sites).

Tested on a Xiaomi/Chuangmi ipc017 (SSC323 + GC2053, infinity6), divinus 1e92d52:

• Before: on a freshly started divinus, a single authenticated GET /api/onvif crashes
  it (2/2), and so does GET /api/rtsp; unauthenticated requests get 401 and survive.
• After: /api/onvif → {"enable":true,"enable_auth":true,"auth_user":"rtsp",…},
  /api/rtsp → {…"port":554,"auth_user":"rtsp","audio_codec":"mp3",…}; all other
  /api/* endpoints and / return 200; 5 rounds of 11 concurrent requests (the web UI
  load pattern), 55/55 × 200, same PID, no restart, encoder steady at 20 fps.

🤖 Generated with Claude Code

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Prevent RTSP and ONVIF API crashes during JSON formatting

🐞 Bug fix 🕐 Less than 10 minutes

AI Description

• Prevents authenticated RTSP and ONVIF requests from crashing the server.
• Escapes configuration strings before formatting JSON with valid buffer pointers.

Diagram

sequenceDiagram
    actor Client
    participant Server as Request Handler
    participant Escaper as JSON Escaper
    participant Formatter as Response Formatter
    Client->>Server: GET API settings
    Server->>Escaper: Escape config strings
    Escaper-->>Server: Escaped buffers
    Server->>Formatter: Format JSON with buffers
    Formatter-->>Server: HTTP response
    Server-->>Client: 200 JSON

Loading

High-Level Assessment

The current approach is optimal: it preserves escape_json's length-returning contract while correctly passing its output buffers to %s. Changing the shared helper's return type would be broader, riskier, and unnecessary.

Files changed (1) +5 / -4

Bug fix (1) +5 / -4

server.cPass escaped buffers to RTSP and ONVIF response formatting +5/-4

Pass escaped buffers to RTSP and ONVIF response formatting

• Escapes RTSP usernames, audio codecs, and ONVIF usernames before formatting their JSON responses. The handlers now pass the populated character buffers to %s instead of passing escape_json's integer byte count, preventing invalid-pointer dereferences and SIGSEGV crashes.

src/server.c

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[wberube]

Thank you for your second commit, I truly appreciate those contributions and encourage you to submit anytime again in the future! Un saludo cordial, y ¡gracias de nuevo!