Make internal JSON functions return error codes

Return error codes (0, ENOMEM, or EINVAL) from JSON support functions
instead of returning results directly.  This makes error handling
simpler for functions which assemble JSON objects and then return a
krb5_error_code values.  Adjust all callers.  Use shims in
export_cred.c to minimize changes there; it will be redesigned
internally in a subsequent commit.

6 files changed, 181 insertions, 174 deletions

diff --git a/src/lib/gssapi/krb5/export_cred.c b/src/lib/gssapi/krb5/export_cred.c
index 162547966b..e5ffaf54aa 100644
--- a/src/lib/gssapi/krb5/export_cred.c
+++ b/src/lib/gssapi/krb5/export_cred.c
@@ -44,12 +44,51 @@ add(k5_json_array array, k5_json_value v)
     return 0;
 }
 
+static inline k5_json_number
+number(long long nval)
+{
+    k5_json_number num;
+
+    return k5_json_number_create(nval, &num) ? NULL : num;
+}
+
+static inline k5_json_string
+string(const char *cstring)
+{
+    k5_json_string str;
+
+    return k5_json_string_create(cstring, &str) ? NULL : str;
+}
+
+static inline k5_json_string
+base64string(const void *data, size_t len)
+{
+    k5_json_string str;
+
+    return k5_json_string_create_base64(data, len, &str) ? NULL : str;
+}
+
+static inline k5_json_null
+null(void)
+{
+    k5_json_null n;
+
+    return k5_json_null_create(&n) ? NULL : n;
+}
+
+static inline k5_json_bool
+bool(int truth)
+{
+    k5_json_bool b;
+
+    return k5_json_bool_create(truth, &b) ? NULL : b;
+}
+
 /* Return a JSON null or string value representing str. */
 static k5_json_value
 json_optional_string(const char *str)
 {
-    return (str == NULL) ? (k5_json_value)k5_json_null_create() :
-        (k5_json_value)k5_json_string_create(str);
+    return (str == NULL) ? (k5_json_value)null() : string(str);
 }
 
 /* Return a JSON null or array value representing princ. */
@@ -60,10 +99,10 @@ json_principal(krb5_context context, krb5_principal princ)
     k5_json_string str;
 
     if (princ == NULL)
-        return k5_json_null_create();
+        return null();
     if (krb5_unparse_name(context, princ, &princname))
         return NULL;
-    str = k5_json_string_create(princname);
+    str = string(princname);
     krb5_free_unparsed_name(context, princname);
     return str;
 }
@@ -75,12 +114,11 @@ json_etypes(krb5_enctype *etypes)
     k5_json_array array;
 
     if (etypes == NULL)
-        return k5_json_null_create();
-    array = k5_json_array_create();
-    if (array == NULL)
+        return null();
+    if (k5_json_array_create(&array))
         return NULL;
     for (; *etypes != 0; etypes++) {
-        if (add(array, k5_json_number_create(*etypes)))
+        if (add(array, number(*etypes)))
             goto oom;
     }
     return array;
@@ -96,9 +134,8 @@ json_kgname(krb5_context context, krb5_gss_name_t name)
     k5_json_array array;
 
     if (name == NULL)
-        return k5_json_null_create();
-    array = k5_json_array_create();
-    if (array == NULL)
+        return null();
+    if (k5_json_array_create(&array))
         return NULL;
     if (add(array, json_principal(context, name->princ)))
         goto oom;
@@ -119,10 +156,10 @@ json_keytab(krb5_context context, krb5_keytab keytab)
     char name[1024];
 
     if (keytab == NULL)
-        return k5_json_null_create();
+        return null();
     if (krb5_kt_get_name(context, keytab, name, sizeof(name)))
         return NULL;
-    return k5_json_string_create(name);
+    return string(name);
 }
 
 /* Return a JSON null or string value representing rcache. */
@@ -133,11 +170,11 @@ json_rcache(krb5_context context, krb5_rcache rcache)
     k5_json_string str;
 
     if (rcache == NULL)
-        return k5_json_null_create();
+        return null();
     if (asprintf(&name, "%s:%s", krb5_rc_get_type(context, rcache),
                  krb5_rc_get_name(context, rcache)) < 0)
         return NULL;
-    str = k5_json_string_create(name);
+    str = string(name);
     free(name);
     return str;
 }
@@ -148,13 +185,11 @@ json_keyblock(krb5_keyblock *keyblock)
 {
     k5_json_array array;
 
-    array = k5_json_array_create();
-    if (array == NULL)
+    if (k5_json_array_create(&array))
         return NULL;
-    if (add(array, k5_json_number_create(keyblock->enctype)))
+    if (add(array, number(keyblock->enctype)))
         goto oom;
-    if (add(array, k5_json_string_create_base64(keyblock->contents,
-                                                keyblock->length)))
+    if (add(array, base64string(keyblock->contents, keyblock->length)))
         goto oom;
     return array;
 oom:
@@ -168,12 +203,11 @@ json_address(krb5_address *addr)
 {
     k5_json_array array;
 
-    array = k5_json_array_create();
-    if (array == NULL)
+    if (k5_json_array_create(&array))
         return NULL;
-    if (add(array, k5_json_number_create(addr->addrtype)))
+    if (add(array, number(addr->addrtype)))
         goto oom;
-    if (add(array, k5_json_string_create_base64(addr->contents, addr->length)))
+    if (add(array, base64string(addr->contents, addr->length)))
         goto oom;
     return array;
 oom:
@@ -188,9 +222,8 @@ json_addresses(krb5_address **addrs)
     k5_json_array array;
 
     if (addrs == NULL)
-        return k5_json_null_create();
-    array = k5_json_array_create();
-    if (array == NULL)
+        return null();
+    if (k5_json_array_create(&array))
         return NULL;
     for (; *addrs != NULL; addrs++) {
         if (add(array, json_address(*addrs))) {
@@ -207,12 +240,11 @@ json_authdata_element(krb5_authdata *ad)
 {
     k5_json_array array;
 
-    array = k5_json_array_create();
-    if (array == NULL)
+    if (k5_json_array_create(&array))
         return NULL;
-    if (add(array, k5_json_number_create(ad->ad_type)))
+    if (add(array, number(ad->ad_type)))
         goto oom;
-    if (add(array, k5_json_string_create_base64(ad->contents, ad->length)))
+    if (add(array, base64string(ad->contents, ad->length)))
         goto oom;
     return array;
 oom:
@@ -227,9 +259,8 @@ json_authdata(krb5_authdata **authdata)
     k5_json_array array;
 
     if (authdata == NULL)
-        return k5_json_null_create();
-    array = k5_json_array_create();
-    if (array == NULL)
+        return null();
+    if (k5_json_array_create(&array))
         return NULL;
     for (; *authdata != NULL; authdata++) {
         if (add(array, json_authdata_element(*authdata))) {
@@ -246,8 +277,7 @@ json_creds(krb5_context context, krb5_creds *creds)
 {
     k5_json_array array;
 
-    array = k5_json_array_create();
-    if (array == NULL)
+    if (k5_json_array_create(&array))
         return NULL;
     if (add(array, json_principal(context, creds->client)))
         goto eom;
@@ -255,25 +285,24 @@ json_creds(krb5_context context, krb5_creds *creds)
         goto eom;
     if (add(array, json_keyblock(&creds->keyblock)))
         goto eom;
-    if (add(array, k5_json_number_create(creds->times.authtime)))
+    if (add(array, number(creds->times.authtime)))
         goto eom;
-    if (add(array, k5_json_number_create(creds->times.starttime)))
+    if (add(array, number(creds->times.starttime)))
         goto eom;
-    if (add(array, k5_json_number_create(creds->times.endtime)))
+    if (add(array, number(creds->times.endtime)))
         goto eom;
-    if (add(array, k5_json_number_create(creds->times.renew_till)))
+    if (add(array, number(creds->times.renew_till)))
         goto eom;
-    if (add(array, k5_json_bool_create(creds->is_skey)))
+    if (add(array, bool(creds->is_skey)))
         goto eom;
-    if (add(array, k5_json_number_create(creds->ticket_flags)))
+    if (add(array, number(creds->ticket_flags)))
         goto eom;
     if (add(array, json_addresses(creds->addresses)))
         goto eom;
-    if (add(array, k5_json_string_create_base64(creds->ticket.data,
-                                                creds->ticket.length)))
+    if (add(array, base64string(creds->ticket.data, creds->ticket.length)))
         goto eom;
-    if (add(array, k5_json_string_create_base64(creds->second_ticket.data,
-                                                creds->second_ticket.length)))
+    if (add(array, base64string(creds->second_ticket.data,
+                                creds->second_ticket.length)))
         goto eom;
     if (add(array, json_authdata(creds->authdata)))
         goto eom;
@@ -294,8 +323,7 @@ json_ccache_contents(krb5_context context, krb5_ccache ccache)
     k5_json_array array;
     int st;
 
-    array = k5_json_array_create();
-    if (array == NULL)
+    if (k5_json_array_create(&array))
         return NULL;
 
     /* Put the principal in the first array entry. */
@@ -334,13 +362,13 @@ json_ccache(krb5_context context, krb5_ccache ccache)
     k5_json_string str;
 
     if (ccache == NULL)
-        return k5_json_null_create();
+        return null();
     if (strcmp(krb5_cc_get_type(context, ccache), "MEMORY") == 0) {
         return json_ccache_contents(context, ccache);
     } else {
         if (krb5_cc_get_full_name(context, ccache, &name))
             return NULL;
-        str = k5_json_string_create(name);
+        str = string(name);
         free(name);
         return str;
     }
@@ -352,18 +380,17 @@ json_kgcred(krb5_context context, krb5_gss_cred_id_t cred)
 {
     k5_json_array array;
 
-    array = k5_json_array_create();
-    if (array == NULL)
+    if (k5_json_array_create(&array))
         return NULL;
-    if (add(array, k5_json_number_create(cred->usage)))
+    if (add(array, number(cred->usage)))
         goto oom;
     if (add(array, json_kgname(context, cred->name)))
         goto oom;
     if (add(array, json_principal(context, cred->impersonator)))
         goto oom;
-    if (add(array, k5_json_bool_create(cred->default_identity)))
+    if (add(array, bool(cred->default_identity)))
         goto oom;
-    if (add(array, k5_json_bool_create(cred->iakerb_mech)))
+    if (add(array, bool(cred->iakerb_mech)))
         goto oom;
     /* Don't marshal cred->destroy_ccache. */
     if (add(array, json_keytab(context, cred->keytab)))
@@ -374,11 +401,11 @@ json_kgcred(krb5_context context, krb5_gss_cred_id_t cred)
         goto oom;
     if (add(array, json_keytab(context, cred->client_keytab)))
         goto oom;
-    if (add(array, k5_json_bool_create(cred->have_tgt)))
+    if (add(array, bool(cred->have_tgt)))
         goto oom;
-    if (add(array, k5_json_number_create(cred->expire)))
+    if (add(array, number(cred->expire)))
         goto oom;
-    if (add(array, k5_json_number_create(cred->refresh_time)))
+    if (add(array, number(cred->refresh_time)))
         goto oom;
     if (add(array, json_etypes(cred->req_enctypes)))
         goto oom;
@@ -414,16 +441,14 @@ krb5_gss_export_cred(OM_uint32 *minor_status, gss_cred_id_t cred_handle,
         return status;
     cred = (krb5_gss_cred_id_t)cred_handle;
 
-    array = k5_json_array_create();
-    if (array == NULL)
+    if (k5_json_array_create(&array))
         goto oom;
-    if (add(array, k5_json_string_create(CRED_EXPORT_MAGIC)))
+    if (add(array, string(CRED_EXPORT_MAGIC)))
         goto oom;
     if (add(array, json_kgcred(context, cred)))
         goto oom;
 
-    str = k5_json_encode(array);
-    if (str == NULL)
+    if (k5_json_encode(array, &str))
         goto oom;
     d = string2data(str);
     if (data_to_gss(&d, token))
diff --git a/src/lib/gssapi/krb5/import_cred.c b/src/lib/gssapi/krb5/import_cred.c
index ad9a1110e9..973b9d0152 100644
--- a/src/lib/gssapi/krb5/import_cred.c
+++ b/src/lib/gssapi/krb5/import_cred.c
@@ -205,8 +205,7 @@ json_to_keyblock(k5_json_value v, krb5_keyblock *keyblock)
     s = check_element(array, 1, K5_JSON_TID_STRING);
     if (s == NULL)
         return -1;
-    keyblock->contents = k5_json_string_unbase64(s, &len);
-    if (keyblock->contents == NULL)
+    if (k5_json_string_unbase64(s, &keyblock->contents, &len))
         return -1;
     keyblock->length = len;
     keyblock->magic = KV5M_KEYBLOCK;
@@ -241,8 +240,7 @@ json_to_address(k5_json_value v, krb5_address **addr_out)
     if (addr == NULL)
         return -1;
     addr->addrtype = k5_json_number_value(n);
-    addr->contents = k5_json_string_unbase64(s, &len);
-    if (addr->contents == NULL) {
+    if (k5_json_string_unbase64(s, &addr->contents, &len)) {
         free(addr);
         return -1;
     }
@@ -311,8 +309,7 @@ json_to_authdata_element(k5_json_value v, krb5_authdata **ad_out)
     if (ad == NULL)
         return -1;
     ad->ad_type = k5_json_number_value(n);
-    ad->contents = k5_json_string_unbase64(s, &len);
-    if (ad->contents == NULL) {
+    if (k5_json_string_unbase64(s, &ad->contents, &len)) {
         free(ad);
         return -1;
     }
@@ -361,6 +358,7 @@ json_to_creds(krb5_context context, k5_json_value v, krb5_creds *creds)
     k5_json_number n;
     k5_json_bool b;
     k5_json_string s;
+    unsigned char *data;
     size_t len;
 
     memset(creds, 0, sizeof(*creds));
@@ -418,17 +416,17 @@ json_to_creds(krb5_context context, k5_json_value v, krb5_creds *creds)
     s = check_element(array, 10, K5_JSON_TID_STRING);
     if (s == NULL)
         goto invalid;
-    creds->ticket.data = k5_json_string_unbase64(s, &len);
-    if (creds->ticket.data == NULL)
+    if (k5_json_string_unbase64(s, &data, &len))
         goto invalid;
+    creds->ticket.data = (char *)data;
     creds->ticket.length = len;
 
     s = check_element(array, 11, K5_JSON_TID_STRING);
     if (s == NULL)
         goto invalid;
-    creds->second_ticket.data = k5_json_string_unbase64(s, &len);
-    if (creds->second_ticket.data == NULL)
+    if (k5_json_string_unbase64(s, &data, &len))
         goto invalid;
+    creds->second_ticket.data = (char *)data;
     creds->second_ticket.length = len;
 
     if (json_to_authdata(context, k5_json_array_get(array, 12),
@@ -620,8 +618,7 @@ krb5_gss_import_cred(OM_uint32 *minor_status, gss_buffer_t token,
         *minor_status = ret;
         goto cleanup;
     }
-    v = k5_json_decode(copy);
-    if (v == NULL)
+    if (k5_json_decode(copy, &v))
         goto invalid;
 
     /* Decode the CRED_EXPORT_MAGIC array wrapper. */
diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
index c88b67a6e8..dfec99179b 100644
--- a/src/lib/krb5/krb/get_in_tkt.c
+++ b/src/lib/krb5/krb/get_in_tkt.c
@@ -1124,24 +1124,21 @@ save_selected_preauth_type(krb5_context context, krb5_ccache ccache,
 static krb5_error_code
 clear_cc_config_out_data(krb5_context context, krb5_init_creds_context ctx)
 {
-    if (ctx->cc_config_out != NULL)
-        k5_json_release(ctx->cc_config_out);
-    ctx->cc_config_out = k5_json_object_create();
-    if (ctx->cc_config_out == NULL)
-        return ENOMEM;
-    return 0;
+    k5_json_release(ctx->cc_config_out);
+    ctx->cc_config_out = NULL;
+    return k5_json_object_create(&ctx->cc_config_out);
 }
 
 static krb5_error_code
 read_cc_config_in_data(krb5_context context, krb5_init_creds_context ctx)
 {
+    k5_json_value val;
     krb5_data config;
     char *encoded;
     krb5_error_code code;
     int i;
 
-    if (ctx->cc_config_in != NULL)
-        k5_json_release(ctx->cc_config_in);
+    k5_json_release(ctx->cc_config_in);
     ctx->cc_config_in = NULL;
 
     if (ctx->opte->opt_private->in_ccache == NULL)
@@ -1159,16 +1156,15 @@ read_cc_config_in_data(krb5_context context, krb5_init_creds_context ctx)
     if (i < 0)
         return ENOMEM;
 
-    ctx->cc_config_in = k5_json_decode(encoded);
+    code = k5_json_decode(encoded, &val);
     free(encoded);
-    if (ctx->cc_config_in == NULL)
-        return ENOMEM;
-    if (k5_json_get_tid(ctx->cc_config_in) != K5_JSON_TID_OBJECT) {
-        k5_json_release(ctx->cc_config_in);
-        ctx->cc_config_in = NULL;
+    if (code)
+        return code;
+    if (k5_json_get_tid(val) != K5_JSON_TID_OBJECT) {
+        k5_json_release(val);
         return EINVAL;
     }
-
+    ctx->cc_config_in = val;
     return 0;
 }
 
@@ -1183,9 +1179,9 @@ save_cc_config_out_data(krb5_context context, krb5_ccache ccache,
     if (ctx->cc_config_out == NULL ||
         k5_json_object_count(ctx->cc_config_out) == 0)
         return 0;
-    encoded = k5_json_encode(ctx->cc_config_out);
-    if (encoded == NULL)
-        return ENOMEM;
+    code = k5_json_encode(ctx->cc_config_out, &encoded);
+    if (code)
+        return code;
     config = string2data(encoded);
     code = krb5_cc_set_config(context, ccache, ctx->cred.server,
                               KRB5_CC_CONF_PA_CONFIG_DATA, &config);
diff --git a/src/lib/krb5/krb/init_creds_ctx.h b/src/lib/krb5/krb/init_creds_ctx.h
index 5d813914a4..1bc90a528e 100644
--- a/src/lib/krb5/krb/init_creds_ctx.h
+++ b/src/lib/krb5/krb/init_creds_ctx.h
@@ -50,8 +50,8 @@ struct _krb5_init_creds_context {
     struct krb5_responder_context_st rctx;
     krb5_preauthtype selected_preauth_type;
     krb5_preauthtype allowed_preauth_type;
-    void *cc_config_in;
-    void *cc_config_out;
+    k5_json_object cc_config_in;
+    k5_json_object cc_config_out;
     /* Discovered offset of server time during preauth */
     krb5_timestamp pa_offset;
     krb5_int32 pa_offset_usec;
diff --git a/src/lib/krb5/krb/preauth2.c b/src/lib/krb5/krb/preauth2.c
index 060f98aa00..74a4f27beb 100644
--- a/src/lib/krb5/krb/preauth2.c
+++ b/src/lib/krb5/krb/preauth2.c
@@ -469,22 +469,19 @@ set_cc_config(krb5_context context, krb5_clpreauth_rock rock,
               const char *key, const char *data)
 {
     krb5_init_creds_context ctx = (krb5_init_creds_context)rock;
-    k5_json_value value;
-    int i;
+    krb5_error_code ret;
+    k5_json_string str;
 
     if (ctx->cc_config_out == NULL)
         return ENOENT;
 
-    value = k5_json_string_create(data);
-    if (value == NULL)
-        return ENOMEM;
-
-    i = k5_json_object_set(ctx->cc_config_out, key, value);
-    k5_json_release(value);
-    if (i < 0)
-        return ENOMEM;
+    ret = k5_json_string_create(data, &str);
+    if (ret)
+        return ret;
 
-    return 0;
+    ret = k5_json_object_set(ctx->cc_config_out, key, str);
+    k5_json_release(str);
+    return ret;
 }
 
 static struct krb5_clpreauth_callbacks_st callbacks = {
diff --git a/src/lib/krb5/krb/preauth_otp.c b/src/lib/krb5/krb/preauth_otp.c
index e610d47a94..d343683c02 100644
--- a/src/lib/krb5/krb/preauth_otp.c
+++ b/src/lib/krb5/krb/preauth_otp.c
@@ -99,13 +99,13 @@ codec_data_to_value(krb5_data *data, k5_json_object obj, const char *key)
     if (data->data == NULL)
         return 0;
 
-    str = k5_json_string_create_len(data->data, data->length);
-    if (str == NULL)
-        return ENOMEM;
+    retval = k5_json_string_create_len(data->data, data->length, &str);
+    if (retval)
+        return retval;
 
     retval = k5_json_object_set(obj, key, str);
     k5_json_release(str);
-    return retval == 0 ? 0 : ENOMEM;
+    return retval;
 }
 
 /* Converts a property of a json object into a krb5_int32. */
@@ -135,25 +135,25 @@ codec_int32_to_value(krb5_int32 int32, k5_json_object obj, const char *key)
     if (int32 == -1)
         return 0;
 
-    num = k5_json_number_create(int32);
-    if (num == NULL)
-        return ENOMEM;
+    retval = k5_json_number_create(int32, &num);
+    if (retval)
+        return retval;
 
     retval = k5_json_object_set(obj, key, num);
     k5_json_release(num);
-    return retval == 0 ? 0 : ENOMEM;
+    return retval;
 }
 
 /* Converts a krb5_otp_tokeninfo into a JSON object. */
 static krb5_error_code
 codec_encode_tokeninfo(krb5_otp_tokeninfo *ti, k5_json_object *out)
 {
-    krb5_error_code retval = 0;
+    krb5_error_code retval;
     k5_json_object obj;
     krb5_flags flags;
 
-    obj = k5_json_object_create();
-    if (obj == NULL)
+    retval = k5_json_object_create(&obj);
+    if (retval != 0)
         goto error;
 
     flags = KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN;
@@ -212,60 +212,51 @@ codec_encode_challenge(krb5_context ctx, krb5_pa_otp_challenge *chl,
     k5_json_object obj = NULL, tmp = NULL;
     k5_json_string str = NULL;
     k5_json_array arr = NULL;
-    krb5_error_code retval = 0;
+    krb5_error_code retval;
     int i;
 
-    obj = k5_json_object_create();
-    if (obj == NULL)
-        goto error;
+    retval = k5_json_object_create(&obj);
+    if (retval != 0)
+        goto cleanup;
 
     if (chl->service.data) {
-        str = k5_json_string_create_len(chl->service.data,
-                                        chl->service.length);
-        if (str == NULL)
-            goto error;
+        retval = k5_json_string_create_len(chl->service.data,
+                                           chl->service.length, &str);
+        if (retval != 0)
+            goto cleanup;
         retval = k5_json_object_set(obj, "service", str);
         k5_json_release(str);
-        if (retval != 0) {
-            retval = ENOMEM;
-            goto error;
-        }
+        if (retval != 0)
+            goto cleanup;
     }
 
-    arr = k5_json_array_create();
-    if (arr == NULL)
-        goto error;
+    retval = k5_json_array_create(&arr);
+    if (retval != 0)
+        goto cleanup;
 
     for (i = 0; chl->tokeninfo[i] != NULL ; i++) {
         retval = codec_encode_tokeninfo(chl->tokeninfo[i], &tmp);
         if (retval != 0)
-            goto error;
+            goto cleanup;
 
         retval = k5_json_array_add(arr, tmp);
         k5_json_release(tmp);
-        if (retval != 0) {
-            retval = ENOMEM;
-            goto error;
-        }
-    }
-
-    if (k5_json_object_set(obj, "tokenInfo", arr) != 0) {
-        retval = ENOMEM;
-        goto error;
+        if (retval != 0)
+            goto cleanup;
     }
 
-    *json = k5_json_encode(obj);
-    if (*json == NULL)
-        goto error;
+    retval = k5_json_object_set(obj, "tokenInfo", arr);
+    if (retval != 0)
+        goto cleanup;
 
-    k5_json_release(arr);
-    k5_json_release(obj);
-    return 0;
+    retval = k5_json_encode(obj, json);
+    if (retval)
+        goto cleanup;
 
-error:
+cleanup:
     k5_json_release(arr);
     k5_json_release(obj);
-    return retval == 0 ? ENOMEM : retval;
+    return retval;
 }
 
 /* Converts a JSON object into a krb5_responder_otp_tokeninfo. */
@@ -327,8 +318,8 @@ codec_decode_challenge(krb5_context ctx, const char *json)
     krb5_error_code retval;
     size_t i;
 
-    obj = k5_json_decode(json);
-    if (obj == NULL)
+    retval = k5_json_decode(json, &obj);
+    if (retval != 0)
         goto error;
 
     if (k5_json_get_tid(obj) != K5_JSON_TID_OBJECT)
@@ -384,7 +375,7 @@ codec_decode_answer(krb5_context context, const char *answer,
                     krb5_otp_tokeninfo **tis, krb5_otp_tokeninfo **ti,
                     krb5_data *value, krb5_data *pin)
 {
-    krb5_error_code retval = EBADMSG;
+    krb5_error_code retval;
     k5_json_value val = NULL;
     krb5_int32 indx, i;
     krb5_data tmp;
@@ -392,8 +383,8 @@ codec_decode_answer(krb5_context context, const char *answer,
     if (answer == NULL)
         return EBADMSG;
 
-    val = k5_json_decode(answer);
-    if (val == NULL)
+    retval = k5_json_decode(answer, &val);
+    if (retval != 0)
         goto cleanup;
 
     if (k5_json_get_tid(val) != K5_JSON_TID_OBJECT)
@@ -1196,48 +1187,49 @@ krb5_responder_otp_set_answer(krb5_context ctx, krb5_responder_context rctx,
 {
     krb5_error_code retval;
     k5_json_object obj = NULL;
-    k5_json_value val = NULL;
+    k5_json_number num;
+    k5_json_string str;
     char *tmp;
 
-    obj = k5_json_object_create();
-    if (obj == NULL)
+    retval = k5_json_object_create(&obj);
+    if (retval != 0)
         goto error;
 
-    val = k5_json_number_create(ti);
-    if (val == NULL)
+    retval = k5_json_number_create(ti, &num);
+    if (retval != 0)
         goto error;
 
-    retval = k5_json_object_set(obj, "tokeninfo", val);
-    k5_json_release(val);
+    retval = k5_json_object_set(obj, "tokeninfo", num);
+    k5_json_release(num);
     if (retval != 0)
         goto error;
 
     if (value != NULL) {
-        val = k5_json_string_create(value);
-        if (val == NULL)
+        retval = k5_json_string_create(value, &str);
+        if (retval != 0)
             goto error;
 
-        retval = k5_json_object_set(obj, "value", val);
-        k5_json_release(val);
+        retval = k5_json_object_set(obj, "value", str);
+        k5_json_release(str);
         if (retval != 0)
             goto error;
     }
 
     if (pin != NULL) {
-        val = k5_json_string_create(pin);
-        if (val == NULL)
+        retval = k5_json_string_create(pin, &str);
+        if (retval != 0)
             goto error;
 
-        retval = k5_json_object_set(obj, "pin", val);
-        k5_json_release(val);
+        retval = k5_json_object_set(obj, "pin", str);
+        k5_json_release(str);
         if (retval != 0)
             goto error;
     }
 
-    tmp = k5_json_encode(obj);
-    k5_json_release(obj);
-    if (tmp == NULL)
+    retval = k5_json_encode(obj, &tmp);
+    if (retval != 0)
         goto error;
+    k5_json_release(obj);
 
     retval = krb5_responder_set_answer(ctx, rctx, KRB5_RESPONDER_QUESTION_OTP,
                                        tmp);
@@ -1246,7 +1238,7 @@ krb5_responder_otp_set_answer(krb5_context ctx, krb5_responder_context rctx,
 
 error:
     k5_json_release(obj);
-    return ENOMEM;
+    return retval;
 }
 
 void KRB5_CALLCONV