Fix invalid free in statistics-channel JSON renderer

wrap_jsonfree() called json_object_put() on the response-body buffer
base, which is the JSON string returned by
json_object_to_json_string_ext(), not a struct json_object.  The root
object is already passed in as the callback argument; release only
that.

diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
index f4da50ade3b9750aa30ad7466e301b9e072366e0..ede4eff2cfc2ac719b1a439c66870930f736ea4d 100644 (file)
--- a/bin/named/statschannel.c
+++ b/bin/named/statschannel.c
@@ -2316,9 +2316,7 @@ cleanup:
 }
 
 static void
-wrap_xmlfree(isc_buffer_t *buffer, void *arg) {
-       UNUSED(arg);
-
+wrap_xmlfree(isc_buffer_t *buffer, void *arg ISC_ATTR_UNUSED) {
        xmlFree(isc_buffer_base(buffer));
 }
 
@@ -2461,8 +2459,7 @@ render_xml_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
        } while (0)
 
 static void
-wrap_jsonfree(isc_buffer_t *buffer, void *arg) {
-       json_object_put(isc_buffer_base(buffer));
+wrap_jsonfree(isc_buffer_t *buffer ISC_ATTR_UNUSED, void *arg) {
        if (arg != NULL) {
                json_object_put((json_object *)arg);
        }