core/service: fix memleak of USBFunctionStrings and USBFunctionDescriptors

oss-fuzz #6892.

diff --git a/src/core/service.c b/src/core/service.c
index df36019f6238653aefa82f7b5aba60d9ab1daa37..23a5bcd1c4213f45226499c56d9f1b30bc8ee11e 100644 (file)
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -396,6 +396,9 @@ static void service_done(Unit *u) {
 
         s->bus_name_owner = mfree(s->bus_name_owner);
 
+        s->usb_function_descriptors = mfree(s->usb_function_descriptors);
+        s->usb_function_strings = mfree(s->usb_function_strings);
+
         service_close_socket_fd(s);
         s->peer = socket_peer_unref(s->peer);
 

diff --git a/test/fuzz-regressions/fuzz-unit-file/oss-fuzz-6892 b/test/fuzz-regressions/fuzz-unit-file/oss-fuzz-6892
new file mode 100644 (file)
index 0000000..31f746d
--- /dev/null
+++ b/test/fuzz-regressions/fuzz-unit-file/oss-fuzz-6892
@@ -0,0 +1,3 @@
+service
+[Service]
+USBFunctionStrings=/
\ No newline at end of file

diff --git a/test/fuzz-regressions/meson.build b/test/fuzz-regressions/meson.build
index b1dfc39675c9d654413824e5b44538881701ab1c..f9c8e8cd98aae53edb9791c262f9b78c06d49d31 100644 (file)
--- a/test/fuzz-regressions/meson.build
+++ b/test/fuzz-regressions/meson.build
@@ -33,4 +33,5 @@ fuzz_regression_tests = '''
         fuzz-unit-file/oss-fuzz-6885
         fuzz-unit-file/oss-fuzz-6886
         fuzz-unit-file/oss-fuzz-6917
+        fuzz-unit-file/oss-fuzz-6892
 '''.split()