If parsing jright fails, code frees 'expr' and 'set_expr' before returning but 'elem' may have been allocated as well. To avoid extra conditionals when freeing it, parse jright earlier so the code following conditional 'elem' allocation becomes error-path-free. Fixes: 144d97e151adb ("src: normalize set element with EXPR_MAPPING") Signed-off-by: Phil Sutter --- src/parser_json.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/src/parser_json.c b/src/parser_json.c index 14259ea39777b..224cbb79de1b8 100644 --- a/src/parser_json.c +++ b/src/parser_json.c @@ -1493,13 +1493,6 @@ static struct expr *json_parse_set_expr(struct json_ctx *ctx, return NULL; } - if (expr->etype != EXPR_SET_ELEM) { - elem = set_elem_expr_alloc(int_loc, expr); - } else { - elem = expr; - expr = expr->key; - } - expr2 = json_parse_set_rhs_expr(ctx, jright); if (!expr2) { json_error(ctx, "Invalid set elem at index %zu.", index); @@ -1507,6 +1500,14 @@ static struct expr *json_parse_set_expr(struct json_ctx *ctx, expr_free(set_expr); return NULL; } + + if (expr->etype != EXPR_SET_ELEM) { + elem = set_elem_expr_alloc(int_loc, expr); + } else { + elem = expr; + expr = expr->key; + } + expr2 = mapping_expr_alloc(int_loc, expr, expr2); elem->key = expr2; expr = elem; -- 2.54.0