We construct JSON objects e.g. for setting the VNC password but then
just VIR_FREE the strings cointained inside. If it was the password
string would be kept on the heap. Exchange some cpu cycles for a warm
feeling of security.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
---
 src/util/virjson.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/util/virjson.c b/src/util/virjson.c
index 7a52493c62..0dc091b626 100644
--- a/src/util/virjson.c
+++ b/src/util/virjson.c
@@ -424,7 +424,7 @@ virJSONValueFree(virJSONValuePtr value)
         VIR_FREE(value->data.array.values);
         break;
     case VIR_JSON_TYPE_STRING:
-        VIR_FREE(value->data.string);
+        VIR_DISPOSE_STRING(value->data.string);
         break;
     case VIR_JSON_TYPE_NUMBER:
         if (virPinIsJanos(value->data.number))
-- 
2.20.1

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list