jv_setpath: fix leak when indexing an array with an array #3083
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
arrays[arrays]
is a special case of "INDEX" that actually returns anarray containing the indices in which the array that is being indexed
contains the start of the key array.
So array keys, for array values, are a kind of key that can be "got",
but not "set".
jv_setpath()
was not freeing the value it "got" fromindexing that key, in case the following "set" on that key failed,
resulting in a leak.
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66061
This one was hard to figure out because oss-fuzz really didn't do a
great job minimising the reproducer, and the stacktrace was not very
helpful.
After figuring out the leak was in
jv_setpath()
, and it had somethingto do with using an array key, I had to keep track of copies/frees in
jv_setpath()
on a piece of paper while stepping the code with gdb tofind the leak! :^)