shared/json: fix memory leak on failed normalization

We need to increase the counter immediately after taking the ref,
otherwise we may not unref it properly if we fail before incrementing.

diff --git a/src/shared/json.c b/src/shared/json.c
index 55e6d95cdbb787553b1a9b60b9f5702e7bfc8058..2e52443dde2b6b68006948711c849c51320963ae 100644 (file)
--- a/src/shared/json.c
+++ b/src/shared/json.c
@@ -4655,10 +4655,11 @@ int json_variant_normalize(JsonVariant **v) {
         if (!a)
                 return -ENOMEM;
 
-        for (i = 0; i < m; i++) {
+        for (i = 0; i < m; ) {
                 a[i] = json_variant_ref(json_variant_by_index(*v, i));
+                i++;
 
-                r = json_variant_normalize(a + i);
+                r = json_variant_normalize(&a[i-1]);
                 if (r < 0)
                         goto finish;
         }

diff --git a/test/fuzz/fuzz-json/leak-normalize-fail b/test/fuzz/fuzz-json/leak-normalize-fail
new file mode 100644 (file)
index 0000000..b247ccd
--- /dev/null
+++ b/test/fuzz/fuzz-json/leak-normalize-fail
@@ -0,0 +1 @@
+[7E73]
\ No newline at end of file