Deal with error paths in callers of dict_attr_alloc_null

diff --git a/src/lib/util/dict_util.c b/src/lib/util/dict_util.c
index 826fdef10c28fa17c5c7b60aa2707cccc2d40e8c..89ab00116a949ded15ac28bf59ea482cdd8acfcd 100644 (file)
--- a/src/lib/util/dict_util.c
+++ b/src/lib/util/dict_util.c
@@ -616,9 +616,23 @@ fr_dict_attr_t *dict_attr_alloc_null(TALLOC_CTX *ctx)
 {
        fr_dict_attr_t *da;
 
+       /*
+        *      Do not use talloc zero, the caller
+        *      always initialises memory allocated
+        *      here.
+        */
        da = talloc(ctx, fr_dict_attr_t);
        if (unlikely(!da)) return NULL;
 
+       /*
+        *      On error paths in the caller, the
+        *      caller may free the attribute
+        *      allocated here without initialising
+        *      the ext array, which is then
+        *      accessed in the destructor.
+        */
+       memset(da->ext, 0, sizeof(da->ext));
+
        talloc_set_destructor(da, _dict_attr_free);
 
        return da;