Pino Toscano <ptosc...@redhat.com> writes:
> qmp_output_start_struct() and qmp_output_start_list() create a new
> QObject (QDict, QList) and push it to the stack of the QmpOutputVisitor,
> where it is saved as 'value'. When freeing the iterator in
> qmp_output_free(), these values are never freed properly.
>
> The simple solution is to qobject_decref() them.
>
> Signed-off-by: Pino Toscano <ptosc...@redhat.com>
> ---
>
> Changes in v2:
> - added Signed-off-by
>
> qapi/qmp-output-visitor.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/qapi/qmp-output-visitor.c b/qapi/qmp-output-visitor.c
> index 9e3b67c..eedf256 100644
> --- a/qapi/qmp-output-visitor.c
> +++ b/qapi/qmp-output-visitor.c
> @@ -220,6 +220,7 @@ static void qmp_output_free(Visitor *v)
> while (!QSLIST_EMPTY(&qov->stack)) {
> e = QSLIST_FIRST(&qov->stack);
> QSLIST_REMOVE_HEAD(&qov->stack, node);
> + qobject_decref(e->value);
> g_free(e);
> }
Hmm. The patch looks correct, even though it adds a decref very similar
to the one deleted by commit f24582d "qapi: fix double free in
qmp_output_visitor_cleanup()". I suspect the bug you fix was introduced
by commit 455ba08 "qmp: Don't abuse stack to track qmp-output root".
Eric?
Should this go into -stable?
