From d5a582e95a0535ba2ec916cf0532dfe29bcd7e6e Mon Sep 17 00:00:00 2001
From: Nikias Bassen
Date: Fri, 13 Feb 2026 01:05:53 +0100
Subject: json: Fix a few memory leaks

---
 src/jplist.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

(limited to 'src')

diff --git a/src/jplist.c b/src/jplist.c
index 996a3a3..0ac1e0b 100644
--- a/src/jplist.c
+++ b/src/jplist.c
@@ -738,6 +738,11 @@ static plist_t parse_array(const char* js, jsmntok_info_t* ti, int* index, uint3
         return NULL;
     }
     plist_t arr = plist_new_array();
+    if (!arr) {
+        PLIST_JSON_ERR("%s: failed to create array node\n", __func__);
+        ti->err = PLIST_ERR_NO_MEM;
+        return NULL;
+    }
     size_t num_tokens = ti->tokens[*index].size;
     size_t num;
     int j = (*index)+1;
@@ -767,6 +772,13 @@ static plist_t parse_array(const char* js, jsmntok_info_t* ti, int* index, uint3
         }
         if (val) {
             plist_array_append_item(arr, val);
+            // if append failed, val still has no parent, free it and abort
+            if (((node_t)val)->parent == NULL) {
+                plist_free(val);
+                plist_free(arr);
+                ti->err = PLIST_ERR_NO_MEM;
+                return NULL;
+            }
         } else {
             plist_free(arr);
             ti->err = PLIST_ERR_PARSE;
@@ -798,6 +810,11 @@ static plist_t parse_object(const char* js, jsmntok_info_t* ti, int* index, uint
         return NULL;
     }
     plist_t obj = plist_new_dict();
+    if (!obj) {
+        PLIST_JSON_ERR("%s: failed to create dict node\n", __func__);
+        ti->err = PLIST_ERR_NO_MEM;
+        return NULL;
+    }
     for (num = 0; num < num_tokens; num++) {
         if (j+1 >= ti->count) {
             PLIST_JSON_ERR("%s: token index out of valid range\n", __func__);
@@ -833,6 +850,14 @@ static plist_t parse_object(const char* js, jsmntok_info_t* ti, int* index, uint
             }
             if (val) {
                 plist_dict_set_item(obj, key, val);
+                // if set failed, val still has no parent, free it and abort
+                if (((node_t)val)->parent == NULL) {
+                    plist_free(val);
+                    free(key);
+                    plist_free(obj);
+                    ti->err = PLIST_ERR_NO_MEM;
+                    return NULL;
+                }
             } else {
                 free(key);
                 plist_free(obj);
-- 
cgit v1.1-32-gdbae