commit 6d3a7213f58da834b0fc869d05f87e86010c66cf
author Bram Moolenaar <Bram@vim.org> Sun Jul 12 14:34:00 2020 +0200
committer Bram Moolenaar <Bram@vim.org> Sun Jul 12 14:34:00 2020 +0200
tree 91d4c5501c6db51ace2814a1b52255d45357ac0c
parent c85156bb897085d7f5a8e4e180287f87bf19b948

patch 8.2.1188: memory leak with invalid json input

Problem:    Memory leak with invalid json input.
Solution:   Free all keys at the end. (Dominique Pellé, closes #6443,
            closes #6442)

src/json.c

diff --git a/src/json.c b/src/json.c
index 8eb6680..c22864d 100644
--- a/src/json.c
+++ b/src/json.c
@@ -594,6 +594,7 @@
 json_decode_item(js_read_T *reader, typval_T *res, int options)
 {
     char_u	*p;
+    int		i;
     int		len;
     int		retval;
     garray_T	stack;
@@ -621,9 +622,6 @@
 	    if (*p == NUL)
 	    {
 		retval = MAYBE;
-		if (top_item->jd_type == JSON_OBJECT)
-		    // did get the key, clear it
-		    clear_tv(&top_item->jd_key_tv);
 		goto theend;
 	    }
 	    if (top_item->jd_type == JSON_OBJECT_KEY
@@ -925,7 +923,6 @@
 		top_item->jd_key = tv_get_string_buf_chk(cur_item, key_buf);
 		if (top_item->jd_key == NULL)
 		{
-		    clear_tv(cur_item);
 		    emsg(_(e_invarg));
 		    retval = FAIL;
 		    goto theend;
@@ -1001,7 +998,6 @@
 		{
 		    semsg(_("E938: Duplicate key in JSON: \"%s\""),
 							     top_item->jd_key);
-		    clear_tv(&top_item->jd_key_tv);
 		    clear_tv(cur_item);
 		    retval = FAIL;
 		    goto theend;
@@ -1060,7 +1056,10 @@
     semsg(_(e_json_error), p);
 
 theend:
+    for (i = 0; i < stack.ga_len; i++)
+	clear_tv(&(((json_dec_item_T *)stack.ga_data) + i)->jd_key_tv);
     ga_clear(&stack);
+
     return retval;
 }