sd-event: Fix sd_event_source leak

Hinted by CID#1591563 but the issue is different -- when
sd_event_source_set_destroy_callback() fails, we would use the old
n_sources value and possibly missing sd_event_source_unref() of the last
added source.

diff --git a/src/libsystemd/sd-event/event-util.c b/src/libsystemd/sd-event/event-util.c
index 482df37225c565c49ac9433a0104552c3f6b49cf..9e0dbd30c3b0d42bbfe3be1b902208c47a63c88f 100644 (file)
--- a/src/libsystemd/sd-event/event-util.c
+++ b/src/libsystemd/sd-event/event-util.c
@@ -274,16 +274,17 @@ int event_forward_signals(
                 return -ENOMEM;
 
         FOREACH_ARRAY(sig, signals, n_signals) {
-                r = sd_event_add_signal(e, &sources[n_sources], *sig | SD_EVENT_SIGNAL_PROCMASK, event_forward_signal_callback, child);
+                _cleanup_(sd_event_source_unrefp) sd_event_source *s = NULL;
+                r = sd_event_add_signal(e, &s, *sig | SD_EVENT_SIGNAL_PROCMASK, event_forward_signal_callback, child);
                 if (r < 0)
                         return r;
 
-                r = sd_event_source_set_destroy_callback(sources[n_sources], event_forward_signal_destroy);
+                r = sd_event_source_set_destroy_callback(s, event_forward_signal_destroy);
                 if (r < 0)
                         return r;
 
                 sd_event_source_ref(child);
-                n_sources++;
+                sources[n_sources++] = TAKE_PTR(s);
         }
 
         *ret_sources = TAKE_PTR(sources);