From 6dc652e4d4cea0ef773754bed5a0dfdce7ab2d30 Mon Sep 17 00:00:00 2001 From: Ivan Kruglov Date: Tue, 20 Oct 2026 21:53:17 +0200 Subject: [PATCH] core/varlink: fix credential cleanup on dispatch failure A credential value may be decoded before a later field fails dispatch. The cleanup count only includes fully parsed credentials, leaving the partially parsed item's value allocated and unerased. Clean up the entire zero-initialized array so partially parsed entries are erased and freed as well. Fixes: de2ad965c2ef6f775f61019ad86899bd5a5bf410 (cherry picked from commit 4e9511e7e1335bd9460d54f444ce6012ef179d55) --- src/core/varlink-unit.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/src/core/varlink-unit.c b/src/core/varlink-unit.c index e43395385ea..2e33c10b3c5 100644 --- a/src/core/varlink-unit.c +++ b/src/core/varlink-unit.c @@ -914,16 +914,14 @@ static int dispatch_transient_set_credential_array( {} }; - TransientSetCredential *items = NULL; - size_t n = 0; + TransientSetCredential *items; + size_t n_items; int r; assert(ret_items); assert(ret_n); - CLEANUP_ARRAY(items, n, transient_set_credential_array_free); - - size_t n_items = sd_json_variant_elements(variant); + n_items = sd_json_variant_elements(variant); if (n_items == 0) { *ret_items = NULL; *ret_n = 0; @@ -934,13 +932,15 @@ static int dispatch_transient_set_credential_array( if (!items) return -ENOMEM; - for (; n < n_items; n++) { - r = sd_json_dispatch(sd_json_variant_by_index(variant, n), item_dispatch, /* flags= */ 0, &items[n]); + CLEANUP_ARRAY(items, n_items, transient_set_credential_array_free); + + for (size_t i = 0; i < n_items; i++) { + r = sd_json_dispatch(sd_json_variant_by_index(variant, i), item_dispatch, /* flags= */ 0, &items[i]); if (r < 0) return r; } - *ret_n = n; + *ret_n = n_items; *ret_items = TAKE_PTR(items); return 0; }