From: Ondřej Surý <ondrej@isc.org>
Date: Thu, 21 May 2026 09:07:32 +0000 (+0200)
Subject: Fix invalid free in statistics-channel JSON renderer
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f39089576af3b70a72a4edd4b9dec022dade60b0;p=thirdparty%2Fbind9.git

Fix invalid free in statistics-channel JSON renderer

wrap_jsonfree() called json_object_put() on the response-body buffer
base, which is the JSON string returned by
json_object_to_json_string_ext(), not a struct json_object.  The root
object is already passed in as the callback argument; release only
that.
---

diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
index f4da50ade3b..ede4eff2cfc 100644
--- a/bin/named/statschannel.c
+++ b/bin/named/statschannel.c
@@ -2316,9 +2316,7 @@ cleanup:
 }
 
 static void
-wrap_xmlfree(isc_buffer_t *buffer, void *arg) {
-	UNUSED(arg);
-
+wrap_xmlfree(isc_buffer_t *buffer, void *arg ISC_ATTR_UNUSED) {
 	xmlFree(isc_buffer_base(buffer));
 }
 
@@ -2461,8 +2459,7 @@ render_xml_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	} while (0)
 
 static void
-wrap_jsonfree(isc_buffer_t *buffer, void *arg) {
-	json_object_put(isc_buffer_base(buffer));
+wrap_jsonfree(isc_buffer_t *buffer ISC_ATTR_UNUSED, void *arg) {
 	if (arg != NULL) {
 		json_object_put((json_object *)arg);
 	}