From: Michal Koutný <mkoutny@suse.com>
Date: Mon, 24 Feb 2025 14:44:29 +0000 (+0100)
Subject: sd-event: Fix sd_event_source leak
X-Git-Tag: v258-rc1~1199^2~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1644724a4d167a22c5ac18fb564c911995f7f07b;p=thirdparty%2Fsystemd.git

sd-event: Fix sd_event_source leak

Hinted by CID#1591563 but the issue is different -- when
sd_event_source_set_destroy_callback() fails, we would use the old
n_sources value and possibly missing sd_event_source_unref() of the last
added source.
---

diff --git a/src/libsystemd/sd-event/event-util.c b/src/libsystemd/sd-event/event-util.c
index 482df37225c..9e0dbd30c3b 100644
--- a/src/libsystemd/sd-event/event-util.c
+++ b/src/libsystemd/sd-event/event-util.c
@@ -274,16 +274,17 @@ int event_forward_signals(
                 return -ENOMEM;
 
         FOREACH_ARRAY(sig, signals, n_signals) {
-                r = sd_event_add_signal(e, &sources[n_sources], *sig | SD_EVENT_SIGNAL_PROCMASK, event_forward_signal_callback, child);
+                _cleanup_(sd_event_source_unrefp) sd_event_source *s = NULL;
+                r = sd_event_add_signal(e, &s, *sig | SD_EVENT_SIGNAL_PROCMASK, event_forward_signal_callback, child);
                 if (r < 0)
                         return r;
 
-                r = sd_event_source_set_destroy_callback(sources[n_sources], event_forward_signal_destroy);
+                r = sd_event_source_set_destroy_callback(s, event_forward_signal_destroy);
                 if (r < 0)
                         return r;
 
                 sd_event_source_ref(child);
-                n_sources++;
+                sources[n_sources++] = TAKE_PTR(s);
         }
 
         *ret_sources = TAKE_PTR(sources);