diff options
| author | Emanuele Torre <torreemanuele6@gmail.com> | 2024-03-28 18:10:38 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-03-28 18:10:38 +0100 |
| commit | 5bbd02f581dff4060815e4291b80a9316841195e (patch) | |
| tree | 7c95edc0c7648c7492e0c95292ba6ccd8ed2bfbe /src | |
| parent | afe0afaf0620720b82298b8034e1dd150ba18ca5 (diff) | |
jv_setpath: fix leak when indexing an array with an array
arrays[arrays] is a special case of "INDEX" that actually returns an
array containing the indices in which the array that is being indexed
contains the start of the key array.
So array keys, for array values, are a kind of key that can be "got",
but not "set". jv_setpath() was not freeing the value it "got" from
indexing that key, in case the following "set" on that key failed,
resulting in a leak.
$ ./jq -n '[] | setpath([[1]]; 1)'
jq: error (at <unknown>): Cannot update field at array index of array
=================================================================
==953483==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 272 byte(s) in 1 object(s) allocated from:
#0 0x725f4d4e1359 in __interceptor_malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ec17b1a7438 in jv_mem_alloc src/jv_alloc.c:141
SUMMARY: AddressSanitizer: 272 byte(s) leaked in 1 allocation(s).
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66061
Diffstat (limited to 'src')
| -rw-r--r-- | src/jv_aux.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/jv_aux.c b/src/jv_aux.c index 0a06117e..a08ca88e 100644 --- a/src/jv_aux.c +++ b/src/jv_aux.c @@ -417,6 +417,7 @@ jv jv_setpath(jv root, jv path, jv value) { // to null first. root = jv_set(root, jv_copy(pathcurr), jv_null()); if (!jv_is_valid(root)) { + jv_free(subroot); jv_free(pathcurr); jv_free(pathrest); jv_free(value); |