From 7a276adbbc0cb80fd21de16c44704384841f3598 Mon Sep 17 00:00:00 2001
From: Cory McWilliams <cory@unprompted.com>
Date: Mon, 11 Nov 2024 21:05:29 -0500
Subject: [PATCH] ssb: Size blob ID buffers appropriately.

---
 src/httpd.js.c   | 16 +++++++++-------
 src/ssb.export.c |  2 +-
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/httpd.js.c b/src/httpd.js.c
index 78e22594..61a31b68 100644
--- a/src/httpd.js.c
+++ b/src/httpd.js.c
@@ -1246,7 +1246,7 @@ static void _httpd_endpoint_view_work(tf_ssb_t* ssb, void* user_data)
 {
 	view_t* view = user_data;
 	tf_http_request_t* request = view->request;
-	char blob_id[128] = "";
+	char blob_id[k_blob_id_len] = "";
 
 	user_app_t* user_app = _parse_user_app_from_path(request->path, "/view");
 	if (user_app)
@@ -1339,7 +1339,7 @@ typedef struct _save_t
 {
 	tf_http_request_t* request;
 	int response;
-	char blob_id[256];
+	char blob_id[k_blob_id_len];
 } save_t;
 
 static void _httpd_endpoint_save_work(tf_ssb_t* ssb, void* user_data)
@@ -1416,12 +1416,12 @@ static void _httpd_endpoint_save_work(tf_ssb_t* ssb, void* user_data)
 						size_t new_app_length = 0;
 						const char* new_app_str = JS_ToCStringLen(context, &new_app_length, new_app_json);
 
-						char blob_id[250] = { 0 };
+						char blob_id[k_blob_id_len] = { 0 };
 						if (tf_ssb_db_blob_store(ssb, (const uint8_t*)new_app_str, new_app_length, blob_id, sizeof(blob_id), NULL) &&
 							tf_ssb_db_set_property(ssb, user_app->user, app_path, blob_id))
 						{
 							tf_ssb_db_add_value_to_array_property(ssb, user_app->user, "apps", user_app->app);
-							snprintf(save->blob_id, sizeof(save->blob_id), "/%s", blob_id);
+							snprintf(save->blob_id, sizeof(save->blob_id), "%s", blob_id);
 							save->response = 200;
 						}
 
@@ -1446,10 +1446,10 @@ static void _httpd_endpoint_save_work(tf_ssb_t* ssb, void* user_data)
 		}
 		else if (strcmp(request->path, "/save") == 0)
 		{
-			char blob_id[250] = { 0 };
+			char blob_id[k_blob_id_len] = { 0 };
 			if (tf_ssb_db_blob_store(ssb, request->body, request->content_length, blob_id, sizeof(blob_id), NULL))
 			{
-				snprintf(save->blob_id, sizeof(save->blob_id), "/%s", blob_id);
+				snprintf(save->blob_id, sizeof(save->blob_id), "%s", blob_id);
 				save->response = 200;
 			}
 		}
@@ -1473,7 +1473,9 @@ static void _httpd_endpoint_save_after_work(tf_ssb_t* ssb, int status, void* use
 	tf_http_request_t* request = save->request;
 	if (*save->blob_id)
 	{
-		tf_http_respond(request, 200, NULL, 0, save->blob_id, strlen(save->blob_id));
+		char body[256] = "";
+		int length = snprintf(body, sizeof(body), "/%s", save->blob_id);
+		tf_http_respond(request, 200, NULL, 0, body, length);
 	}
 	tf_http_request_unref(request);
 	tf_free(save);
diff --git a/src/ssb.export.c b/src/ssb.export.c
index f51d634f..0a8df7e8 100644
--- a/src/ssb.export.c
+++ b/src/ssb.export.c
@@ -90,7 +90,7 @@ void tf_ssb_export(tf_ssb_t* ssb, const char* key)
 		return;
 	}
 
-	char app_blob_id[64] = { 0 };
+	char app_blob_id[k_blob_id_len] = { 0 };
 	sqlite3* db = tf_ssb_acquire_db_reader(ssb);
 	sqlite3_busy_timeout(db, 10000);
 	sqlite3_stmt* statement;